SentriaOne xSIEM Documentation

📄️Dashboard UI Overview

How to navigate and work with the SentriaOne xSIEM dashboard — menu structure, time range, refresh, and drill-down navigation.

The main Overview page of SentriaOne xSIEM — detection, throughput, protocol, data volume, and geographic summaries with their drill-downs.

Security Overview page — detection severity, categories, MITRE ATT&CK coverage, detection tracking, and top risks, with drill-downs into Detections.

Detections page — Triage, Grouped, All Events, and MITRE Map views, filters, and how to open a detection for investigation.

How to read a detection detail page — what happened, risk signals, records, MITRE ATT&CK mitigations — and how to track the investigation.

Network Overview page — traffic, connections, active hosts, TCP health, top hosts and flows, and the metric drill-down pages.

Perimeter page — traffic between internal hosts and external autonomous system organizations and countries.

Relation page — interactive communication and detection graph between hosts, with filters and display options.

Application Overview page — HTTP, DNS, SSL/TLS, database, and authentication activity, error trends, and protocol drill-down pages.

Activity page — per-protocol activity views for DNS, HTTP, SSL/TLS, network, and other observed protocols.

Assets pages — asset inventory summary, device list search, device groups, and the asset-centric profile of a device.

Records page — searching the underlying records with Basic, Advanced, and AI Search Assistant modes, refining results, and exporting.

Reports page — generating on-demand reports, scheduling report delivery by email, and managing generated report history.

Dashboards page — organizing and viewing custom dashboards built from widgets.

Data Feed Health page — confirming that mirrored traffic and log data are arriving and being analyzed.

License page — license validity, network sensor and log source usage against licensed limits, and license server status.