Default Cards

The Incident Status by Assignment card displays incidents that are assigned to the current logged in user and others, based on the incident status. Using this card, you can quickly see incident status and assignees.

The High Impact Incidents card displays the top priority compromises known to Cisco XDR.

The card displays the name of the incident, when it was created, its status, to whom its assigned, and the source. Click the name of the incident to view more information in the incident details.

The MITRE ATT&CK^® Incidents card displays the tactics and techniques reported by incidents over the selected timeframe. When you hover over the bar graph, it displays the number of incidents reported by each technique for the specified tactic.

The Top Targeted Assets card displays an overview of the number of incidents reported by the top six assets in descending order, over the selected timeframe.

The Unassigned Incidents card displays a list of incidents that have not been assigned to a user over a selected timeframe, organized by the color-coded priority score assigned to the incidents. The priority score is calculated from detection risk (including incident severity and TTP-based risk of financial loss) and asset value at risk (based on the value of assets involved in the incident). Click the name of the incident to view more information in the incident details.

The Detection Sources card displays the number of incidents reported by the sources listed, over the selected timeframe. This is useful for users to see when there are spikes in the number of incidents.

The Team Mean Time Summary card displays the following data for your organization:

• Mean Time to Engage - The average time the status of the incidents changed from New to one of the Open statuses by users within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe. This allows you to quickly see the average time it took for users within your organization to respond to a new incident during the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

• Incidents Engaged - The total number of incidents that changed from New to one of the Open statuses by users within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe.

• Mean Time to Resolution - The average time the status of the incidents changed from one of the Open statuses to one of the Closed statuses by users within the selected timeframe. An Open status only includes incidents that were opened by users during the selected timeframe. This allows you to quickly see the average time it took for users within your organization to open and resolve incidents during the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

• Incidents Resolved - The total number of incidents that changed from one of the Open statuses to one of the Closed statuses by users within the selected timeframe. An Open status only includes incidents that users opened during the selected timeframe.

  

The User Mean Time Summary card displays the following data:

• Mean Time to Engage - The average time the status of the incidents changed from New to one of the Open statuses by you within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe. This allows you to quickly see the average time it took for you to respond to a new incident within the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

• Incidents Engaged - The total number of incidents that you changed from New to one of the Open statuses within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe.

• Mean Time to Resolution - The average time the status of the incidents changed from one of the Open statuses to one of the Closed statuses by you within the selected timeframe. An Open status only includes incidents that you opened during the selected timeframe. This allows you to quickly see the average time it took for you to open and resolve incidents within the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

• Incidents Resolved - The total number of incidents that you changed from one of the Open statuses to one of the Closed statuses within the selected timeframe. An Open status only includes incidents that you opened during the selected timeframe.

  

The Top Workflow Runs card shows the total workflow runs for the top 10 workflows over the selected timeframe, and the workflow names and number of runs during that time.

The Workflow Runs Over Time card shows the total number of workflows that ran each day during the selected date range. This can be useful for seeing trends in your workflow runs. Hover the mouse over an item in the bar graph to see the total runs for that date.

The Workflows Added By Category card shows the number of workflows created or imported during the selected date range and the number of workflows tagged to the top 5 categories for the selected date range. Hover the mouse over one of the colored segments of the circle graph to see the category name and number of workflows assigned to that category during the selected date range.

The Average Workflow Run Time card shows the per day average time that your workflows took to complete during the selected date range. Hover the mouse over a point in the line graph to see the average workflow run time for that date.

The Workflow Runs by Category card shows the top 5 categories based on the number of workflow runs during the selected timeframe. Hover the mouse over an item in the bar graph to see the number of workflow runs for each category on that date.

The Computer Summary card shows the number of computers and their issues such as those with conflicting instance key, no instance key, failed package install, failed package reconfigure, and without identity.

The Unified Connector Stats card shows the number of unified connectors and their stats such as those with conflicting keys, without key, install failures, reconfigure failures, and without identity.

Displays a mulcardvel pie chart that shows, based on the selected time frame, in the outer ring:

• new Secure Cloud Analytics alerts created within the time frame

• open Secure Cloud Analytics alerts created before the time frame, and not yet closed within the time frame

• closed Secure Cloud Analytics alerts closed during the time frame

And in the inner ring:

• assigned Secure Cloud Analytics alerts

• unassigned Secure Cloud Analytics alerts

Displays the current number of open Secure Cloud Analytics alerts and unassigned Secure Cloud Analytics alerts.

Displays the number of unique entities that Secure Cloud Analytics detected transmitting traffic on your network during a given time frame, displayed as a vertical bar chart.

Displays the last ingested time and the last verified time for each integrated detection source.

Displays the total number of observations that Secure Cloud Analytics generated in a given time frame, and the total number of highlighted observations in that time frame. The Observations and Highlighted Observations links take you to the Secure Cloud Analytics portal UI to view more information about these observations.

Displays a list of your configured Secure Cloud Analytics sensors, and if they are active or inactive.

Displays the amount of inbound traffic, inbound encrypted traffic, outbound traffic, and outbound encrypted traffic monitored by Secure Cloud Analytics for the selected time frame as a stacked bar chart.