Security Incidents Dashboard

Selecting Security Incidents from the Dashboards menu displays the Security Incidents dashboard, which summarizes and highlights the most important current and historical information for Security Incidents from an overview perspective.

  • Time Range dropdown filter – Specifies the time range of displayed data from the past 7 days to the past year.

  • SEVERITY dropdown filter– Limits displayed data to all or one of the following severity levels: Critical, High, Medium, Low.

  • IMPACT dropdown filter– Limits displayed data to all or one of the one of the five severity levels.

  • RESOLVE REASONdropdown filter– Limits displayed data to all or one of the possible resolution reasons. Resolve reason definitions are provided here.

  • Incidents By Category – Security Incident cases grouped by Incident Category. The case must have an Incident Category value assigned and must have been created in the selected time range.

  • Incidents By Kill Chain Phase – Security Incident cases grouped by Cyber Kill Chain Phase. The case must have a Cyber Kill Chain Phase value assigned and must have been created in the selected time range.

  • Incidents By Impact – Security Incident cases grouped by Impact. The case must have an Impact value assigned and must have been created in the selected time range.

  • Incidents By Severity – Security Incident cases grouped by Detection Severity. The case must have a Detection Severity value assigned and must have been created in the selected time range.

  • Total Incidents Escalated – The count of Security Incident cases that were Escalated to Customer (Status). The case must have been created in the selected time range. The percentage of Security Incident cases that were Escalated to Customer is shown beneath the count.

  • Mean Time to Customer Validation – The average time difference between when a Security Incident case Status was changed to Escalated to Customer and when the case Status was changed to “Containment”. The case must have transitioned to Containment in the selected time range.

  • Mean Time to Acknowledge – The average time difference between when a Security Incident case Status was changed to Escalated To Customer and when the case Status was changed to another Status or Closed. The case Status must have changed to Escalated To Customer in the selected time range. For customers that use the “Customer Validation” status, then “Mean Time to Acknowledge” is the time between “Escalated to Customer” and “Customer Validation”.

  • Total Threat Hunting Incidents – Security Incident cases that have the Threat Hunting flag set. The case must have been created in the selected time range.

  • Top Notable Security Incidents – Security Incident cases that have the Notable Case flag set. The case must have been opened in the selected time range. The Report displays all cases. The UI shows the 10 most recent (ordered by time closed).

  • Top Aging Escalated Cases – All security incident cases that have been opened in the time period and are still open and escalated to customer at the end of the period. The age is the number of full days from when the case was escalated to customer to the end of the time period. The Report displays all cases. The UI shows the 10 oldest (ordered by age).

  • Closed Incidents by Reason Code – Closed Security Incident cases grouped by Resolve Reason. The case must have been Closed in the selected time range.

  • Opened vs Closed Incidents – The cumulative count of Security Incident cases opened and closed in the selected time range.

Report Scheduler

Clicking the Report Scheduler button displays a form to specify a report to be automatically generated and appended as a PDF to an email that is forwarded to recipients based on the following criteria:

  • SCHEDULER NAME– Specifies the name of the scheduled report.

  • DASHBOARDS– Specifies which dashboards will be included in the report.

  • SCHEDULE– Specifies whether the report should be run immediately, daily, weekly, or monthly.

  • RECIPIENTS – Specifies the recipients who will receive the report.

  • SUBJECT LINE (OPTIONAL) – Specifies an optional subject line for the report message.

  • MESSAGE (OPTIONAL) – Specifies a message for the report.

Security Incident report metrics

The security incident report generated from the scheduler presents the following case trend metrics:

  • Security Incidents – All security incidents that were detected by rules, and includes cases dismissed from the Threats screen. The case must have been opened in the selected time range.
  • Cases Opened– All security incident cases that were opened in the specified time period and excludes cases that were dismissed from the Threats screen.
  • Cases Escalated– The count of Security Incident cases that were Escalated to Customer. The case must have been opened in the selected time range; however the case may have been escalated to customer after the end of the selected time range.
  • Cases Escalated (Open)– All security incident cases that have been opened in the time period and are still open and escalated to customer at the end of the period.
  • Cases Closed– All security incident cases that were closed in the specified time period. Includes cases that were dismissed from the Threats screen.
  • Aging Cases > 7 days– All security incident cases that are open and have been escalated to customer for more than 7 days at the end of the period.
  • Health Monitoring Cases– All Health Incident cases that were opened in the specified time period.