Using Dashboards and Reports Effectively
Morning Routine:
- Open Analyst Triage Queue or Security Operations Overview dashboard
- Review Signals Requiring Attention widget
- Check Signals : New report for unclaimed signals
- Review Malicious & Critical widget for active threats
- Check Cases Requiring Attention for urgent cases
Throughout the Day:
- Monitor dashboard widgets for real-time updates
- Use reports to investigate specific patterns or issues
- Check Signals : Oldest periodically to prevent backlog
End of Day:
- Review Signals By Status to ensure signals are progressing
- Check Cases By Status for case workflow health
- Document any trends or issues observed
Weekly Reviews
Performance Analysis:
- Review Signals : Verdict & Severity Overall for trends
- Analyze AI Verdicts vs. Manual Verdicts for accuracy
- Check Routing Rule Management for rule effectiveness
- Review Signals : Oldest and Cases : Oldest for backlog
Optimization:
- Adjust routing rules based on match patterns
- Update priorities based on verdict and severity trends
- Identify and address workflow bottlenecks
Customizing Reports
Creating Custom Reports:
- Navigate to the application (Case Management, Threat Intelligence, and so on.)
- Go to Reports section
- Click Add to create a new report
- Configure filters, columns, and sorting
- Save the report for future use
Best Practices for Custom Reports:
- Use descriptive names that indicate the report's purpose
- Include relevant filters to narrow results
- Add columns that provide actionable information
- Set appropriate default sorting (for example, by creation date or priority)
- Share reports with team members who need them
Interpreting Metrics
Signal Volume Trends:
- Monitor daily signal counts to identify volume spikes
- Compare current volume to historical averages
- Investigate sudden increases in signal volume
Verdict Distribution:
- Track ratio of malicious to benign verdicts
- Monitor false positive rates
- Identify trends in suspicious verdicts
Resolution Times:
- Track time from signal creation to resolution
- Identify signals exceeding SLA thresholds
- Monitor case resolution times
Enrichment Coverage:
- Track percentage of signals with completed TI enrichment
- Monitor enrichment completion times
- Identify observables without enrichment results