🌙
 

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Taegis™ ManagedXDR Dashboard

dashboards alerts investigations widgets managedxdr


The Taegis™ ManagedXDR Dashboard features several widgets that enable security managers to:

Taegis™ ManagedXDR Dashboard

Taegis™ ManagedXDR Dashboard

Accessing the Dashboard

To access the Taegis™ ManagedXDR Dashboard, open the Dashboards menu from the left-hand side navigation and select ManagedXDR.

Only users using a tenant with a Taegis™ ManagedXDR subscription are able to view the ManagedXDR Dashboard.

Edit the ManagedXDR Dashboard using the following tips.

Edit Dashboard Settings

Date/Time

The ManagedXDR Dashboard uses master date/time settings, which change the time period of all widgets at the same time.

Change the time period using the drop-down date/time picker at the top right of the dashboard. The default time period is 72 Hours, but choosing a custom time period overwrites it. The most recent time period selected becomes the new default.

Date/Time Picker

Date/Time Picker

Note

Alerts may be searched for any time period.

However, event data is treated differently and can be searched for any period of 31 days or less in duration. Event data can be queried either from Advanced Search by choosing any non-Alert Type or from Quick Search. When using either of these ways to query event data, a custom date picker allows you to specify a search time range. From this custom date picker, you can select any start date for which the account may have retained data. But when selecting the end date for the search time range, note that the number of days in the range (the difference between the start and end date) must be less than or equal to 31 days.

Trend Lines vs. Percentages

Several widgets display percentages and trend lines. The percentage compares the selected time period to the previous time period. The trend line provides additional context by depicting the selected time period plus the previous three time periods.

For example, if the time scope for the Event Pipeline widget is Last 72 Hours, the number compares to the 3 days prior, and the trend line depicts the last 12 days.

Negative Anomaly No Anomaly Positive Anomaly
Negative Anomaly No Anomaly Positive Anomaly
The current value is beyond the established threshold (+/- 2 standard deviations) between this period and the last period, and those changes are negatively anomalous. The current value is within the established threshold (+/- 2 standard deviations) between this period and the last period, meaning there are no anomalies. The current value is beyond the established threshold (+/- 2 standard deviations) between this period and the last period, and those changes are positively anomalous.

Anomaly Thresholds in Taegis™ XDR

Widgets

Event Pipeline

The Event Pipeline widget highlights the breakdown of event filtering via ManagedXDR, through the following metrics:

Event Pipeline Widget

Event Pipeline Widget

Below each metric is a percentage and a trend line, which compare the current time period being viewed to previous time periods. (See Trend Lines vs. Percentages to learn about what each represents.) Select one of the metrics to open up a side drawer with more detailed information about the alerts or investigations.

Export Data

Tip

For users opted in to Preview mode, see Export Data for changes to exporting widget data.

Select the download icon icon on any widget to download a CSV of the current chart. The Event Pipeline CSV file contains the following fields:

Tip

You can also download a CSV of the side drawer data tables when you drill down into ManagedXDR Dashboard metrics.

Ongoing Investigations

The Ongoing Investigations widget displays any investigation that is currently open, active, or awaiting action.

Ongoing Investigations Widget

Ongoing Investigations Widget

Tip

Want to assign an ongoing investigation to someone? See Hand Off an Investigation.

Export Data

Tip

For users opted in to Preview mode, see Export Data for changes to exporting widget data.

Select the download icon icon on any widget to download a CSV of the current chart. The Ongoing Investigations CSV file contains the following fields:

Tip

You can also download a CSV of the side drawer data tables when you drill down into ManagedXDR Dashboard metrics.

Mean Response Times

The Mean Response Times widget highlights MDR’s impact on the timeliness of event handling, through the following three metrics:

Response Time Widget

Response Time Widget

Below each metric is a percentage that compares the current time period being viewed to previous time periods. (See Trend Lines vs. Percentages to learn about what each represents.) Select one of the metrics to open up a side drawer with more detailed information about the events, alerts, or investigations.

Scatter Chart

Select one of the metrics to open up a side drawer with additional information. This includes a scatter chart which maps how the individual response times and mean response time correspond with the Service Level Agreement (SLA). Below the chart is a list of all matching investigations or alerts.

Some tips for reading the scatter chart:

Export Data

Tip

For users opted in to Preview mode, see Export Data for changes to exporting widget data.

Select the download icon icon on any widget to download a CSV of the current chart. The Response Time CSV file contains the following fields:

Tip

You can also download a CSV of the side drawer data tables when you drill down into ManagedXDR Dashboard metrics.

Completed Investigations

The Completed Investigations widget displays the total number of completed investigations for the selected time period, and a percentage comparing the selected time period to the previous time period. It also features a bar chart breaking down the investigations into the following categories:

Select one of the bars to open up a side drawer with a list of matching investigations for that category, including their status.

Completed Investigations Widget

Completed Investigations Widget

Export Data

Tip

For users opted in to Preview mode, see Export Data for changes to exporting widget data.

Select the download icon icon on any widget to download a CSV of the current chart. The Completed Investigations CSV file contains the following fields:

Tip

You can also download a CSV of the side drawer data tables when you drill down into ManagedXDR Dashboard metrics.

Note

Completed Investigations also has two sub-widgets: Confirmed Security Incidents and False Positives.

Confirmed Security Incidents

Confirmed Security Incidents is a sub-widget of Completed Investigations that provides an overview of which resolved security incidents were most significant to your organization. It displays how many investigations with the close code ’Confirmed Security Incidents’ there were in the selected time period, and what MITRE ATT&CK™ Initial Access Vector they map to, if available. It also displays a trend bar chart and percentage comparing the number of confirmed security incidents to the previous four time periods, both overall and per Initial Access Vector category.

Important

The large-sized number displays a count of investigations with the close code ’Confirmed Security Incidents.’ Initial Access Vectors are not always associated with an investigation or may have multiple associations. As a result, the sum of these Initial Access Vectors may exceed or be less than the total number of ’Confirmed Security Incidents’ investigations.

Confirmed Security Incidents Widget

Confirmed Security Incidents Widget

Initial Access Vector Information

Select one of the Initial Access Vector metrics to open up a side drawer with more detailed information about the confirmed security incidents in that category. This includes a bar chart of the confirmed security incidents in the selected time period.

Some tips for reading this chart:

Export Data

Select the download icon icon on any widget to download a CSV of the current chart. The Confirmed Security Incidents CSV file contains the following fields:

Tip

You can also download a CSV of the side drawer data tables when you drill down into ManagedXDR Dashboard metrics.

False Positives

False Positives is a sub-widget of Completed Investigations that displays the number of false positives in the selected time period. A breakdown is provided by the detector that generated the genesis alert. It also displays a trend bar chart and percentage that compares the number of false positives to the previous three. The widget also displays a pie chart representation of the proportion of genesis alerts by detector type for the current period.

Important

The large-sized number displays a count of investigations with the close code ’False Positive.’ The number of detectors represented in the pie chart is calculated based on which genesis alerts associated with the investigation are classified as ’False Positive.’ Because an investigation can have 1 to n number of genesis alerts, the sum of these detectors may exceed or be less than the total number of ’False Positive’ investigations.

Tip

See Trend Lines vs. Percentages to learn about the difference between the trend data and the percentage.

False Positives

False Positives

Total Hunting Leads Investigated (ManagedXDR Elite Only)

Note

This widget is only available to ManagedXDR Elite customers.

The Total Hunting Leads Investigated widget displays a pie chart of all open alerts that have been triaged during the selected time period, broken down according to their status:

Hover over a pie segment for the total count of each status.

Total Hunting Leads Investigated Widget

Total Hunting Leads Investigated Widget

Hunting Summary (ManagedXDR Elite Only)

Note

This widget is only available to ManagedXDR Elite customers.

The Hunting Summary widget displays counts of the following Threat Hunting metrics:

Below each metric is a percentage and a trend line, which compare the current time period being viewed to previous time periods. (See Trend Lines vs. Percentages to learn about what each represents.)

Hunting Summary Widget

Hunting Summary Widget

Export Options

Export Widget Data

Select the download icon icon on any widget to download a CSV of the current chart. For more information about what the CSV file contains, see individual widget descriptions.

Tip

For users opted in to Preview mode, see Export Data for changes to exporting widget data.

Export Table Data

Download a CSV of the side drawer data tables when you drill down into ManagedXDR metrics:

  1. Select one of the metrics from a widget to open up a side drawer with more detailed information.
  2. Open the Actions menu and select Export All as CSV to download all of the table’s data.
  3. Or, use the checkmarks to select individual rows. Then open the Actions menu and select Export Selected as CSV.

Export Table Data

Export Table Data

Export Dashboard to PNG

To export the entire dashboard to a PNG image file, select Actions from the top right of the dashboard and choose Download as PNG. The file automatically downloads.

Export Dashboard to PNG

Export Dashboard to PNG

Export Widgets to PNG

To export an individual widget to a PNG image file, select the vertical ellipsis from the top right of the desired widget and choose Download as PNG. The file automatically downloads.

Export Widget to PNG

Export Widget to PNG

Tip

You can also export the visuals resulting from drilling down into certain widgets to PNG.

Export Data

For users opted in to Preview mode, you can export data from the dashboard or individual widgets to a CSV or JSON file:

Export Dashboard Data

Export Dashboard Data

Export Widget Data

Export Widget Data

 

On this page: