---
title: Using Dashboards and Reports Effectively
slug: solutions/using-dashboards-and-reports-effectively
docTags: 
createdAt: 2026-03-04T10:54:12.821Z
---

**Morning Routine:**

1. Open **Analyst Triage Queue** or **Security Operations Overview** dashboard
2. Review **Signals Requiring Attention** widget
3. Check **Signals : New** report for unclaimed signals
4. Review **Malicious & Critical** widget for active threats
5. Check **Cases Requiring Attention** for urgent cases

**Throughout the Day:**

- Monitor dashboard widgets for real-time updates
- Use reports to investigate specific patterns or issues
- Check **Signals : Oldest** periodically to prevent backlog

**End of Day:**

- Review **Signals By Status** to ensure signals are progressing
- Check **Cases By Status** for case workflow health
- Document any trends or issues observed

### Weekly Reviews

**Performance Analysis:**

1. Review **Signals : Verdict & Severity Overall** for trends
2. Analyze **AI Verdicts** vs. **Manual Verdicts** for accuracy
3. Check **Routing Rule Management** for rule effectiveness
4. Review **Signals : Oldest** and **Cases : Oldest** for backlog

**Optimization:**

- Adjust routing rules based on match patterns
- Update priorities based on verdict and severity trends
- Identify and address workflow bottlenecks

### Customizing Reports

**Creating Custom Reports:**

1. Navigate to the application (**Case Management**, **Threat Intelligence**, and so on.)
2. Go to **Reports** section
3. Click **Add** to create a new report
4. Configure filters, columns, and sorting
5. Save the report for future use

**Best Practices for Custom Reports:**

- Use descriptive names that indicate the report's purpose
- Include relevant filters to narrow results
- Add columns that provide actionable information
- Set appropriate default sorting (for example, by creation date or priority)
- Share reports with team members who need them

### Interpreting Metrics

**Signal Volume Trends:**

- Monitor daily signal counts to identify volume spikes
- Compare current volume to historical averages
- Investigate sudden increases in signal volume

**Verdict Distribution:**

- Track ratio of malicious to benign verdicts
- Monitor false positive rates
- Identify trends in suspicious verdicts

**Resolution Times:**

- Track time from signal creation to resolution
- Identify signals exceeding SLA thresholds
- Monitor case resolution times

**Enrichment Coverage:**

- Track percentage of signals with completed TI enrichment
- Monitor enrichment completion times
- Identify observables without enrichment results