If you access the Security Intelligence feature and the button is not displayed, the MongoDB database is not running. The solution is to restart the Sentinel system.
The main graph and the time slider can display different data because of the potential differences in granularity.
If an anomaly definition display name changes but the anomaly was fired in both the old name and the new name within the selected time range, the anomaly shows two filters: the old anomaly display name with its firing count and new anomaly display name with its firing count.
If you filter on the new anomaly, only the new anomaly name is shown in the list, but the Show x of y anomaly message shows x as the total count of the anomaly fired under the new name and y as the total count of the anomaly fired in both the new and old display names.
The x will never equal y if there are events fired in both names within selected date range.
For example, assume that there is an anomaly definition of DemoDef that was renamed to DemoDef-nameChanged within the selected time range and it has fired under the old name 60 times and under the new name 180 times. In the filter drop-down list, both anomalies are displayed, showing DemoDef (fired 60 times) and DemoDef-nameChanged (fired 180 times) for a total of 240. If you filter on DemoDef, the filter message displays, Showing 60 of 240 anomalies. If you filter on DemoDef-nameChanged, the filter message displays, Showing 180 of 240 anomalies.
When the dashboard is bigger, the time granularity is bigger, so it page refreshes slowly. In another words, the date range for the bigger display takes longer to show a difference. Even though the auto refresh timer is the same, it might need to fire two times before you see any change in data.