Alert dashboards allow you to analyze and study common patterns in alerts, such as:
Types of alerts
Average time owners take to close alerts
The correlation rule generating the maximum number of alerts
Geographical origin and destination of high-severity alerts
Oldest open alerts
Alerts that took the longest time to close
To view the alert dashboard:
Log in to Sentinel and click the Alerts Dashboard.
As you visualize and monitor alerts, you can perform the following activities in the alert dashboard:
Mouse over specific areas in the charts to view more information.
Select desired areas in the chart to filter the alert data. As you select a specific area in the chart, Sentinel filters the alerts in rest of the charts and tables in the dashboard. Click Filtering to remove the applied filters and go back to the unfiltered view.
(Optional) You can customize the default view and save the dashboard. For information about customizing the dashboard, see Customizing the Alert Dashboard.
You can create custom charts and tables for analysis. You can filter and refine the data further as you select certain areas in the charts and use the query and filter options.
For example, you are a Security Operations Center manager in a multi-tenant environment, and you want to analyze and investigate alerts in detail and also understand how your team is handling the alerts. You can perform the following analysis in the alert dashboard:
Investigate Alerts: You can view the alerts generated over time, number of open alerts versus closed alerts, top correlation rules generating the most number of alerts, oldest open alerts, any spikes in alerts at a specific time range, and so on.
Monitor team performance:
The type of alerts the team has been working on
How the alert load is distributed among top owners
Time taken to close alerts of specific priorities
Find the team member owning the most number of alerts
Team members that took longest to investigate alerts
Monitor performance against tenant service-level agreement (SLA): You can view alerts from various tenants, analyze the most number of alerts from a specific tenant, time taken to investigate or close alerts for a specific tenant compared to other tenants, and so on.
The Alert dashboard provides a customizable and an easy-to-configure interface that helps you to view and investigate alerts in detail.
To create or view alerts in the dashboard, you must either be an administrator or have the permission to manage alerts. Depending on the alert permissions and the tenant you belong to, Sentinel displays the relevant alerts in the dashboard.
The Alert dashboard provides some pre-configured visualizations that provide information about alerts such as the following:
Overview: Displays a time series chart that shows alerts generated in Sentinel over time. You can inspect the time series charts for any spikes, which can indicate increase in attacks in your organization. You can drag and select the time period when the spike occurred to zoom into the alerts. As you select the specific time range, Sentinel filters the dashboard for alerts in the selected time range. Also, you can find out the geographical locations from where the alerts originated.
To view geographical locations from where the alerts originated, ensure that the IpToCountry.csv file is populated by using the IP2Location Feed plug-in. For more information, see the IP2Location Feed documentation on the Sentinel Plug-ins Website.
Alert Load: Provides information about the alerts at a granular level such as the following:
Topmost alerts in your enterprise
Alert distribution among top alert owners
Total number of alerts in individual alert states
Number of alerts received from each tenant
Total number of alerts based on priority
Performance rows: Provides statistical information about how efficiently alerts are investigated and closed based on priority, correlation rule, alert owners, and tenants.
Details: Provides detailed alerts information such as the oldest open alerts, number of times the duplicate alerts were rolled up, and all alert fields.
The alert dashboard displays all alerts in your local Sentinel server. To view alerts from other Sentinel servers, you need to view the alerts in the Alert Views. For more information, see Creating an Alert View. The alert dashboard displays only distinct alerts. Duplicate alerts are rolled up to a single distinct alert. For more information about the rolling up of duplicate alerts, see Configuring Alert Creation
in the Sentinel Administration Guide.
Sentinel leverages Kibana, a browser-based analytics and search dashboard, that helps you to visualize and analyze data. The dashboard is a collection of visualizations. You can modify or create new visualizations and dashboards with the data you want to visualize. For information about creating visualizations and dashboards, see Visualize and Dashboard section in Kibana documentation.
You can search for alerts in your Sentinel system by using the Discover option in Kibana. To search for alerts, select alerts.alerts as the Index Pattern. For more information, see Discover section in Kibana documentation.