Executive Summary dashboard
The Executive Summary dashboard is designed to provide a high level insight into security operations so that executives can evaluate security trends over time based on key metrics, notables, risk, and other additional metrics. Use the Executive Summary dashboard to prioritize security operations, monitor the overall health and evaluate the risk to your organization.
Dashboard panels
Key metrics
Panel | Description and default search |
---|---|
Mean Time to Triage | Displays the average time (in minutes) to triage or prioritize the investigation of a notable over the duration of a specified time period. Also, displays a trendline (in absolute value) that indicates how the mean time taken to triage the notable compares to the previous mean time taken to triage the notable over the same time period. For example, the trendline may display that the mean time to triage a notable over the last 7 days is 0.5% up or down over the mean time taken to triage the notable during the previous 7 day time period. For more information, see Triage notable events in Splunk Enterprise Security.
|
Mean Time to Resolution | Displays the average time (in minutes) taken by the notable to reach its configured end status over the duration of a specified time period. Also, displays a trendline (in absolute value) that indicates how the mean time taken by the notable to reach its configured end status compares to the previous mean time taken by the notable to reach its configured end status over the same time period. For more information, see Take action on notable events in Splunk Enterprise Security.
|
Investigations Created | Displays the number of investigations created in the SOC over the duration of a specified time period. Also, displays a trendline (in absolute value) that indicates how the mean number of investigations created compares to the previous mean number of investigations created over the same time period. For more information, see Start an investigation in Splunk Enterprise Security.
|
You can access the Key Performance Indicator (KPI) panel for Investigations Created on the Executive Summary Dashboard. Only the admin
and the ess_admin
roles have the manage_all_investigations
capability by default. For all other roles such as ess_analyst
or ess_user
, you see an error message on the Investigations Created KPI panel.
An administrator can add the manage_all_investigations
capability for users that allows other users to access the Investigations Created KPI panel on the Executive Summary dashboard. For more information on adding capabilities to a specific role, see Specify role capabilities.
Notables
Panel | Description and default search |
---|---|
Distribution by Urgency | Displays the distribution of the urgency level that is calculated based on the severity and priority level of a notable over the duration of a specified time period. The distribution is based on the following categories: Critical, High, Medium, Low, Information, and Unknown. For more information, see How urgency is assigned to a notable event in Splunk Enterprise Security.
|
Notables by Domain | Displays the classification of the notables by security domains, such as Access, Endpoint, Network, Threat, Identity, and Audit over the duration of a specified time period.
|
Untriaged Notables by Domain | Displays the classification the untriaged notables by security domain, such as Access, Endpoint, Network, Threat, Identity, and Audit over the duration of a specified time period.
|
Top 10 Untriaged Notables by Source | Displays the top 10 untriaged notables by their sources over the duration of a specified time period.
|
Untriaged Notables by Type | Displays the classification of notables based on whether they are risk notables or regular notables over the duration of a specified time period.
|
Frequent Notables Event Sources |
Displays the sources that generate the most number of notables over the duration of a specified time period.
|
Displays the sources that generate the least number of notables over the duration of a specified time period.
|
Risk
Panel | Description and default search |
---|---|
Risk Notables vs Notable Events | Displays a comparison graph of regular notables versus risk notables in the SOC over the duration of a specified time period.
|
Risk Events Contributing to Risk Notables | Displays a comparison graph of risk events that generated risk notables versus the risk events that did not generate risk notables over the duration of a specified time period.
|
Risk Event Types Not Contributing to Risk Notables | Displays a list in descending order of frequency of the type of risk events that did not generate risk notables over the duration of a specified time period.
|
Additional Metrics
Panel | Description and default search |
---|---|
Adaptive Response Actions Triggered | Displays a graph indicating the type and frequency of the adaptive response actions that were triggered over the duration of a specified time period.
|
Sources with Notable Action vs Risk Action Enabled | Displays a graph indicating how many enabled sources have risk actions versus notables actions over the duration of a specified time period.
|
Correlation Searches Enabled vs Disabled | Displays a bar chart that provides a distribution of the correlation searches enabled versus correlation searches disabled in the SOC over the duration of a specified time period.
|
For key indicator panels and time chart visualizations on the Executive Summary dashboard, some arguments in the underlying SPL searches may be dynamically updated based on the time range selected on the dashboard UI.
Security Posture dashboard | SOC Operations dashboard |
This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.1, 7.0.2, 7.1.0, 7.1.1, 7.1.2, 7.2.0, 7.3.0, 7.3.1, 7.3.2
Feedback submitted, thanks!