Default Tiles

The Private Intelligence, Automation, and Secure Client tiles are automatically available for you to add to your dashboard on the Dashboards page. You do not need to add the integrations to access the tiles. However, to generate incidents, we recommend that you configure integrations to provide endpoint data, such as Secure Endpoint, Secure Cloud Analytics, and Umbrella. For details on how to configure integrations, see Integrations.

The following Private Intelligence tiles are available to all users in the Customize Dashboards dialog box:

The Incident Status by Assignment tile displays incidents that are assigned to the current logged in user and others, based on the incident status. Using this tile, you can quickly see incident status and assignees.

The High Impact Incidents tile displays the top priority compromises known to Cisco XDR.

The tile displays the name of the incident, when it was created, its status, to whom its assigned, and the source. Click the name of the incident to view more information in the incident details.

The MITRE ATT&CK® Incidents tile displays the tactics and techniques reported by incidents over the selected timeframe. When you hover over the bar graph, it displays the number of incidents reported by each technique for the specified tactic and a link to the MITRE ATT&CK® page for more information on the technique.

Note: Only tactics reported by incidents are displayed in the tile. If a tactic is not listed, it is because there are no tactics, techniques, and procedures in the selected timeframe related to that tactic.

The Top Targeted Assets tile displays an overview of the number of incidents reported by the top six assets in descending order, over the selected timeframe.

The Unassigned Incidents tile displays a list of incidents that have not been assigned to a user over a selected timeframe, organized by the color-coded priority score assigned to the incidents. The priority score is calculated from detection risk (including incident severity and TTP-based risk of financial loss) and asset value at risk (based on the value of assets involved in the incident). Click the name of the incident to view more information in the incident details.

The Detection Sources tile displays the number of incidents reported by the sources listed, over the selected timeframe. This is useful for users to see when there are spikes in the number of incidents.

The Team Mean Time Summary tile displays the following data for your organization:

  • Mean Time to Engage - The average time the status of the incidents changed from New to Open by users within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe. This allows you to quickly see the average time it took for users within your organization to respond to a new incident during the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

  • Incidents Engaged - The total number of incidents that changed from New to Open status by users within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe.

  • Mean Time to Resolution - The average time the status of the incidents changed from Open to Closed by users within the selected timeframe. The Open status only includes incidents that were opened by users during the selected timeframe. This allows you to quickly see the average time it took for users within your organization to open and resolve incidents during the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

  • Incidents Resolved - The total number of incidents that changed from Open to Closed status by users within the selected timeframe. The Open status only includes incidents that users opened during the selected timeframe.

The User Mean Time Summary tile displays the following data:

  • Mean Time to Engage - The average time the status of the incidents changed from New to Open by you within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe. This allows you to quickly see the average time it took for you to respond to a new incident within the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

  • Incidents Engaged - The total number of incidents that you changed from New to Open status within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe.

  • Mean Time to Resolution - The average time the status of the incidents changed from Open to Closed by you within the selected timeframe. The Open status only includes incidents that you opened during the selected timeframe. This allows you to quickly see the average time it took for you to open and resolve incidents within the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

  • Incidents Resolved - The total number of incidents that you changed from Open to Closed status within the selected timeframe. The Open status only includes incidents that you opened during the selected timeframe.

The following Automation tiles are available to all users in the Customize Dashboards dialog box:

The Top Workflow Runs tile shows the total workflow runs for the top 10 workflows over the selected timeframe, and the workflow names and number of runs during that time.

The Workflow Runs Over Time tile shows the total number of workflows that ran each day during the selected date range. This can be useful for seeing trends in your workflow runs. Hover the mouse over an item in the bar graph to see the total runs for that date.

The Workflows Added By Category tile shows the number of workflows created or imported during the selected date range and the number of workflows tagged to the top 5 categories for the selected date range. Hover the mouse over one of the colored segments of the circle graph to see the category name and number of workflows assigned to that category during the selected date range.

The Average Workflow Run Time tile shows the per day average time that your workflows took to complete during the selected date range. Hover the mouse over a point in the line graph to see the average workflow run time for that date.

The Workflow Runs by Category tile shows the top 5 categories based on the number of workflow runs during the selected timeframe. Hover the mouse over an item in the bar graph to see the number of workflow runs for each category on that date.

The following Secure Client tiles are available to all users in the Customize Dashboards dialog box:

The Computer Summary tile shows the number of computers and their issues such as those with conflicting instance key, no instance key, failed package install, failed package reconfigure, and without identity.

The Unified Connector Stats tile shows the number of unified connectors and their stats such as those with conflicting keys, without key, install failures, reconfigure failures, and without identity.