Dashboard Tiles

Displays the tactics and techniques reported by incidents over the selected timeframe. When you hover over the bar graph, it displays the number of incidents reported by each technique for the specified tactic and a link to the MITRE ATT&CK® page for more information on the technique.

Note: Only tactics reported by incidents are displayed in the tile. If a tactic is not listed, it is because there are no tactics, techniques, and procedures in the selected timeframe related to that tactic.

Displays an overview of the number of incidents reported by the top six assets in descending order, over the selected timeframe.

Displays a list of incidents that have not been assigned to a user over a selected timeframe, organized by the severity of the incidents.

Displays the number of incidents reported by the sources listed, over the selected timeframe. This is useful for users to see when there are spikes in the number of incidents.

Displays the following data for your organization:

• Mean Time to Engage - The average time the status of the incidents changed from New to Open by users within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe. This allows you to quickly see the average time it took for users within your organization to respond to a new incident during the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

• Incidents Engaged - The total number of incidents that changed from New to Open status by users within the selected timeframe. The New status only includes incidents that were created by a system during the selected timeframe.

• Mean Time to Resolution - The average time the status of the incidents changed from Open to Closed by users within the selected timeframe. The Open status only includes incidents that were opened by users during the selected timeframe. This allows you to quickly see the average time it took for users within your organization to open and resolve incidents during the selected timeframe. It also displays the increased or decreased time from the previous day, week, or month, depending on the selected timeframe.

• Incidents Resolved - The total number of incidents that changed from Open to Closed status by users within the selected timeframe. The Open status only includes incidents that users opened during the selected timeframe.

Displays a multilevel pie chart that shows, based on the selected time frame, in the outer ring:

• new Secure Cloud Analytics alerts created within the time frame

• open Secure Cloud Analytics alerts created before the time frame, and not yet closed within the time frame

• closed Secure Cloud Analytics alerts closed during the time frame

And in the inner ring:

• assigned Secure Cloud Analytics alerts

• unassigned Secure Cloud Analytics alerts

This tile summarizes Secure Firewall Threat Defense events in Security Services Exchange that have been promoted to incidents within the timeframe selected, up to 7 days.

The tile displays the reasons that events were promoted to incidents, which can be:

• Automatically by the system (Talos Disposition)

  Intrusion events that involve an IP address with a poor Talos IP reputation score are automatically promoted to incidents. If you have enabled auto-promotion of malware events in Security Services Exchange, this metric also includes malware events with a poor source IP reputation score.

• Automatically based on your organization's configured auto-promote settings in Security Services Exchange.

  These settings are located in Security Services Exchange by clicking Cloud Services > Eventing > > Auto-Promote Events

  Security Intelligence categories (DNS, URL, and IP addresses) include events promoted based on matches based on Talos threat intelligence data and, if Security Services Exchange is configured to automatically promote events based on custom security intelligence lists and feeds, those events as well.

  The other configurable auto-promotion reasons are Intrusion Rules Category, Malware Threat Score, and Custom IP Address.

• Manually by a user from the Events page in Security Services Exchange. (User Promoted)

Select or deselect check boxes to modify the graph display.

For more information about promoting events to incidents, see the online help in Security Services Exchange.

This tile summarizes the Talos reputation scores of the public IP addresses associated with intrusion and malware events sent from Secure Firewall Threat Defense to Security Services Exchange within the timeframe selected (up to 7 days.)

This value is based on the same threat data as the Talos Disposition value in the Incident Promotion Reason tile, but the counts may differ because of the way they are calculated. For example, Talos IP Reputation counts source and destination IP addresses separately, while the Talos Disposition value increments only once per incident, even if both source and destination IP addresses have poor reputation.

The Talos IP Reputation threat metric used to promote events from Security Services Exchange to incidents is not used in Secure Firewall Threat Defense devices. It is similar to, but different from, the Security Intelligence data for networks.

You can view event details in Security Services Exchange by clicking a metric in this tile. Security Services Exchange will open in a separate browser window.

The count of events shown in Security Services Exchange may differ from the count of events shown in the tile. Duplicate events are automatically removed from Security Services Exchange, and your configurations in Security Services Exchange may automatically filter out events. The tile shows the event count before such actions are taken in Security Services Exchange.

List of top attackers for intrusion events in your organization that were sent from Secure Firewall Threat Defense devices to Security Services Exchange.

This tile shows up to 7 days worth of data, even if a longer timeframe is selected at the top of the dashboard. Look at the timeframe selected on the tile itself.

List of top targets for intrusion events in your organization that were sent from Secure Firewall Threat Defense devices to Security Services Exchange.

This tile shows a maximum of 7 days worth of data, even if a longer timeframe is selected at the top of the dashboard. Look at the timeframe selected on the tile itself.

List of top signatures for intrusion events in your organization that were sent from Secure Firewall Threat Defense devices to Security Services Exchange.

This tile shows a maximum of 7 days worth of data, even if a longer timeframe is selected at the top of the dashboard. Look at the timeframe selected on the tile itself.

Important: In order to use this tile, Cisco Success Network must be enabled in each Secure Firewall Threat Defense. Enable this feature on the System > Smart Licenses page in Secure Firewall Management Center. If you have questions, search the Secure Firewall Management Center online help for "Cisco Success Network".

This tile shows only data from deployments with Secure Firewall Management Center. Devices managed by Secure Firewall Device Manager are not reflected in this tile.

This tile shows whether the Secure Firewall Management Center appliances that are registered to Cisco XDR, and their managed devices, are running at least the suggested software version. This minimum version may not be the latest available software version. Instead, it is determined by Cisco based on software quality, stability, and longevity.

For best protection, all of your Secure Firewall Management Centers and all managed devices should be running at least the suggested version. For upgrade instructions, see the Cisco Firepower Management Center Upgrade Guide at https://www.cisco.com/c/en/us/support/security/defense-center/products-installation-guides-list.html.

Clicking the Suggested version link takes you to the Software Downloads page on Cisco.com for Virtual Appliance downloads. The same download can be used for all virtual and hardware Secure Firewall Management Center appliances.

A zero (0) in the Managed devices needing upgrade column indicates that all of this Secure Firewall Management Center's managed devices are up to date.

Important: In order to use this tile, Cisco Success Network must be enabled in each Secure Firewall Management Center. Enable this feature on the System > Smart Licenses page in Secure Firewall Management Center. If you have questions, search the Secure Firewall Management Center online help for "Cisco Success Network".

This tile shows only data from deployments with Secure Firewall Management Center. Devices managed by Secure Firewall Device Manager are not reflected in this tile.

For effective protection, your system should always use the latest threat intelligence.

If this tile shows that your deployment is not up to date, download and install the latest updates.

For information about these updates and options and instructions for manually or automatically installing them, see the "System Updates" chapter in your Secure Firewall Management Center online help.