Security Posture dashboard

The Security Posture dashboard is the home screen for the Splunk App for Enterprise Security, designed to provide high-level insight into the notable events across all domains in your deployment, suitable for display in a Security Operations Center (SOC). This dashboard shows all events from the past 24 hours, along with the trends over the past 24 hours, and auto-updates in real time providing real-time information on events.

Dashboard panels

Panel	Description
Key Indicators	Displays the count of notable events by security domain over the past 24 hours. For more information, see Key indicators in this manual.
Notable Events by Urgency	Displays the notable events by Urgency for the last 24 hours. Notable Events by Urgency uses an urgency calculation based on the priority assigned to the asset and the severity assigned to the correlation search. The drilldown redirects the page to the Incident Review dashboard showing all notable events with the selected urgency in the last 24 hours.
Notable Events Over Time	Displays a time line of notable events by security domain. The drilldown redirects the page to the Incident Review dashboard showing all notable events in the selected security domain and time frame.
Top Notable Events	Displays the top notable events by rule name, including a total count and a sparkline to represent activity spikes over time. The drilldown redirects the page to the Incident Review dashboard scoped to the selected notable event rule.
Top Notable Event Sources	Displays the top 10 notable event by src, including a total count, a count per correlation and domain, and a sparkline to represent activity spikes over time. The drilldown redirects the page to the Incident Review dashboard scoped to the selected