Default Cards

The Team Mean Time To Contain card displays the average time the status of the incidents initially changed from any of the New statuses to the Open: Contained status within the current organization during the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe. This allows you to quickly see the average time it took for your organization to effectively contain a new incident. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe. For details on incident statuses, see Available Statuses.

The Team Mean Time To Resolve card displays the average time the status of the incidents that last changed from any of the Open statuses to any of the Closed statuses within the current organization during the selected timeframe. An Open status only includes incidents that were opened by users during the selected timeframe. This allows you to quickly see the average time it took for your organization to open and resolve incidents. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe. For details on incident statuses, see Available Statuses.

The MITRE ATT&CK^® Incidents card displays the tactics and techniques reported by incidents over the selected timeframe. When you hover over the bar graph, it displays the number of incidents reported by each technique for the specified tactic.

The Marked as false positive card displays the percentage of incidents that were manually set to the Closed: False Positive status by users out of the total number of incidents set to any of the Closed statuses within the selected timeframe. It also displays the increased or decreased number of incidents from the previous day, week, or month, depending on the selected timeframe.

The Team Mean Time To Engage card displays the average time the status of the incidents initially changed from the New: Presented status to any of the Open statuses within the current organization during the selected timeframe. This allows you to quickly see the average time it took for your organization to start investigating a new incident. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe. For details on incident statuses, see Available Statuses.

The Detection Sources card displays the number of incidents reported by the sources listed, over the selected timeframe. This is useful for users to see when there are spikes in the number of incidents.

The User Mean Time To Resolve card displays the average time the status of the incidents that last changed from any of the Open statuses to any of the Closed statuses by you within the selected timeframe. An Open status only includes incidents that were opened by you during the selected timeframe. This allows you to quickly see the average time it took for you to open and resolve incidents. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe. For details on incident statuses, see Available Statuses.

The Top Targeted Assets card displays an overview of the number of incidents reported by the top six assets in descending order, over the selected timeframe.

The Unassigned Incidents card displays a list of incidents that have not been assigned to a user over a selected timeframe, organized by the color-coded priority score assigned to the incidents. The priority score is calculated from detection risk (including incident severity and TTP-based risk of financial loss) and asset value at risk (based on the value of assets involved in the incident). Click the name of the incident to view more information on the Incident Detail page.

The User Mean Time To Engage card displays the average time the status of the incidents initially changed from the New: Presented status to any of the Open statuses by you within the selected timeframe. This allows you to quickly see the average time it took for you to start investigating a new incident. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe. For details on incident statuses, see Available Statuses.

The Incidents by priority card displays all the incidents that have a priority score of 800 or above. Incidents with any closed status are excluded from the list. Each incident displays the name, when it was created, its status, and to whom its assigned. Click the name of the incident to view more information in the incident detail. This allows you to quickly see which incidents need immediate attention.

The Incident Status by Assignment card displays incidents that are assigned to you and others, based on the incident status, within the selected timeframe. When you hover over the status bar graph, it displays the total number of incidents, the number of incidents assigned to you, and the number of incidents assigned to other users within your organization. Using this card, you can quickly see incident status and assignees.

The User Mean Time To Contain card displays the average time the status of the incidents initially changed from any of the New statuses to the Open: Contained status by you during the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe. This allows you to quickly see the average time it took for you to effectively contain a new incident. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe. For details on incident statuses, see Available Statuses.

The Top workflow runs card shows the total workflow runs for the top 10 workflows over the selected timeframe, and the workflow names and number of runs during that time.

The Workflow runs over time card shows the total number of workflows that ran each day during the selected date range. This can be useful for seeing trends in your workflow runs. Hover the mouse over a line in the graph to see the total runs for that date.

The Workflows added by category card shows the number of workflows created or imported during the selected date range and the number of workflows tagged to the top 5 categories for the selected date range. Hover the mouse over one of the colored segments of the circle graph to see the category name and number of workflows assigned to that category during the selected date range.

The Average workflow run time card shows the per day average time that your workflows took to complete during the selected date range. Hover the mouse over a point in the line graph to see the average workflow run time for that date.

The Workflow runs by category card shows the top 5 categories based on the number of workflow runs during the selected timeframe. Hover the mouse over an item in the bar graph to see the number of workflow runs for each category on that date.

The Cloud Management Failures Summary card shows the number of endpoints with issues, such as those with conflicting instance key, no instance key, failed package install, failed package reconfigure, and without identity.

The Cloud Management Statistics card shows the number of Cloud Management connectors and their stats such as those with conflicting keys, without key, install failures, reconfigure failures, and without identity.

Displays a pie chart that shows, based on the selected time frame, in the outer ring:

• new Secure Cloud Analytics alerts created within the time frame

• open Secure Cloud Analytics alerts created before the time frame, and not yet closed within the time frame

• closed Secure Cloud Analytics alerts closed during the time frame

And in the inner ring:

• assigned Secure Cloud Analytics alerts

• unassigned Secure Cloud Analytics alerts

Displays the current number of open Secure Cloud Analytics alerts and unassigned Secure Cloud Analytics alerts.

Displays the number of unique entities that Secure Cloud Analytics detected transmitting traffic on your network during a given time frame, displayed as a vertical bar chart.

Displays the last ingested time and the last verified time for each integrated detection source.

Displays the total number of observations that Secure Cloud Analytics generated in a given time frame, and the total number of highlighted observations in that time frame. The Observations and Highlighted Observations links take you to the Secure Cloud Analytics portal UI to view more information about these observations.

Displays a list of your configured Secure Cloud Analytics sensors, and if they are active or inactive.

Displays the amount of inbound traffic, inbound encrypted traffic, outbound traffic, and outbound encrypted traffic monitored by Secure Cloud Analytics for the selected time frame as a stacked bar chart.