Dashboards
Dashboards provide real-time visibility into SOC operations through interactive widgets. Use dashboards to monitor current state, identify trends, and quickly access records requiring attention.
Choose Your Path
If You Want To... | Go To |
|---|---|
Run day-to-day analyst triage and SOC overview dashboards | |
Open the ingestion workspace | |
Review return-on-investment metrics | |
Configure tenant credentials before using dashboards |
AI SOC Workspaces Overview
Current AI SOC Core Solution packages include these workspaces for dashboards and reporting:
Workspace | Primary audience | Purpose |
|---|---|---|
AI SOC (or AI SOC Workspace) | Analysts and SOC leads | Triage, investigation throughput, MITRE coverage, threat intelligence, routing rules |
AI Ingestion | Ingestion owners | AI Ingestion and Alert Schema Store, plus the AI Ingestion dashboard |
ROI Calculator Workspace | Leadership and program owners | Return-on-investment metrics for automation and AI SOC value |
If your environment lists different workspace titles, open Workspaces and select the view that matches your role.
AI SOC Workspace Dashboards
The AI SOC workspace includes these dashboards: Routing Rule Management, Analyst Triage Queue, Security Operations Overview, MITRE ATT&CK Techniques, Threat Intelligence Overview, and KB Article Management. If your workspace lists different dashboard titles, open Dashboards under the AI SOC workspace and use the view that matches your need (queue, overview, MITRE, threat intelligence, or knowledge base).
Analyst Triage Queue
The Analyst Triage Queue dashboard supports daily operations on Case Management workload: active queue, ownership, blocked work, and priority or severity views.
Location: Navigate to Dashboards β Analyst Triage Queue
Cards included (package default):
- Active Triage Queue
- Requires Attention by Current Owner
- Cases Created Over Time
- Assigned per Analyst
- Blocked Cases
- Blocked Cases by Current Owner
- Ongoing Cases by Priority
- Ongoing Case Severity
- Incident Count
- Ongoing Incident List
- Ongoing Incidents and Cases by Priority Chart
Security Operations Overview
The Security Operations Overview dashboard gives leadership-style visibility: AI outcomes, throughput, dwell and response times, and case criticality.
Location: Navigate to Dashboards β Security Operations Overview
Cards included (package default):
- Auto Closed by Hero AI
- Security Manager Sankey
- Case Average Dwell Time by Type (min)
- MTTR by Source
- AI Verdicts
- Analyst Cases per Week Heatmap
- MTTD by Source
- CASE - Cases by Criticality
MITRE ATT&CK Techniques
The MITRE ATT&CK Techniques dashboard focuses on technique coverage.
Location: Navigate to Dashboards β MITRE ATT&CK Techniques
Cards included (package default):
- MITRE ATT&K Heatmap
Threat Intelligence Overview
The Threat Intelligence Overview dashboard summarizes observable volume and enrichment activity.
Location: Navigate to Dashboards β Threat Intelligence Overview
Cards included (package default):
- Observables by Type
- Observables Enriched Over Time
KB Article Management
The KB Article Management dashboard lists knowledge base articles for review.
Location: Navigate to Dashboards β KB Article Management
Cards included (package default):
- Manage KB Articles
The card lists articles with Tracking ID and Title. Select articles to enable or disable them. Open a row to edit the article, or delete it after you confirm. Convert fills Conditions for selected legacy articles that do not have Conditions yet. Convert All does that for every matching article and ignores the selection.
Routing Rule Management Dashboard
The Routing Rule Management dashboard helps administrators monitor and optimize signal routing rules.
Location: Navigate to Dashboards β Routing Rule Management
Widgets Included:
- Routing Rule Mgmt Widget
- Purpose: Provides overview of routing rule performance and matches
- When to Use: Monitor rule effectiveness and identify rules needing adjustment
- Action: Review rule match counts and adjust rules as needed
- Add New Rule: Use Add New Rule to create a new routing rule from the widget
- Reordering: Use the drag handle in the Order column to reorder rules by drag and drop and change evaluation order
- Open rule or playbook: Use the icon next to the associated playbook name to open the playbook, or the edit icon on a row to open the triage rule for editing
- Manual Run: Use Run Rule Against Pending Signals to run the selected rule against signals that are pending routing. Expand Records Matched to see which signals were matched by the rule.
- Best Practice: Review weekly to optimize routing logic
Key Metrics to Monitor:
- Number of rules enabled vs. disabled
- Rules with highest match counts
- Rules with no recent matches (may need updating or removal)
- Rule execution errors or failures
AI Ingestion Workspace
The AI Ingestion workspace holds the AI Ingestion application, Alert Schema Store, and the AI Ingestion dashboard. The dashboard cards are Ingestion Records and Alert Schema Store Records.
- Navigate to Workspaces β AI Ingestion.
- Open AI Ingestion to configure a vendor pipeline. See AI SOC Ingestionο»Ώ.
Operational Views
Use Security Operations Overview and Analyst Triage Queue in the AI SOC workspace for operational views. This package does not include a separate SOC Reporting application or workspace. Case-level reporting is the Reporting widget on Case Investigation. The attachment is After Actions Report. The button is Generate After Actions Report.
ROI Calculator Workspace
The ROI Calculator application and ROI Calculator Workspace help you quantify value from AI SOC automation (for example time saved, cases auto-closed by Hero AI, and analyst efficiency). Use this workspace for executive or program reviews.
- Navigate to Workspaces β ROI Calculator Workspace.
- Review default ROI views and inputs shipped with the solution.
- Adjust inputs to match your organizationβs assumptions where the workspace allows customization.
ROI views depend on data from Case Management and related AI SOC workflows. Ensure ingestion, enrichment, and case updates are flowing before you rely on ROI metrics for leadership reporting.
Related Configuration Guides
Dashboards and reports reflect data from configured applications, assets, and sync. Complete these guides before you expect accurate widgets:
Configuration topic | Guide |
|---|---|
Install and verify AI SOC Core Solution (applications, workspaces, playbooks) | |
AI SOC Tenant Configuration (account, tenant, base URL, and personal access token) | |
AI SOC solution overview |