Security Overview
The Security Overview page summarizes the security posture for the selected time range. Almost every element on this page opens a filtered view of Detections.
Menu: Security › Overview
Summary cards
| Card | Shows | Drill-down |
|---|---|---|
| Detections | Total detections | Detections › All Events |
| High | Detections with High severity | Detections › All Events, filtered to High severity |
| Medium | Detections with Medium severity | Detections filtered by severity |
| Low | Detections with Low severity | Detections filtered by severity |
| Alert Types | Number of distinct alert types | Detections › Grouped › By Alert Type |
Panels
Detection Categories
Donut chart of detections by category. Categories include UEBA, C2, Caution, Exfiltration, and Discovery.
MITRE ATT&CK Coverage
Shows how many MITRE ATT&CK tactics have at least one detection (for example
8 / 15 tactics) and the tactics with the most detections.
Select Open MITRE Map → to open Detections › MITRE Map.
Detection Tracking
Counts of detections by tracking status — Open, Acknowledged, In Progress, and Closed — and a Recently Updated list showing who last changed a detection and when. Select Manage → to open the detections that are still open.
Event Timeline
Detections over time, split by severity. Select View all events → to open Detections › All Events.
Detections by Severity
Donut chart of the High, Medium, and Low split.
Top Internal IPs by Risk
Horizontal bar chart of the internal IP addresses with the highest risk score. Click a bar to triage that internal IP. Select Open grouped view → to see all internal IPs.
Top Event Types
Horizontal bar chart of the most frequent event types. Click a bar to triage that event type. Select Open grouped view → to see all alert types.
Top Detections
Table of the highest-risk detections with risk score, detection name, source, destination, category, and time. Select a row to open its detail page, or View all detections → for the full list sorted by risk.
Reading risk and severity
| Term | Meaning |
|---|---|
| Risk | Numeric score (0–100) calculated from the signals behind a detection. Higher is more urgent |
| Severity | Level assigned to a detection: High, Medium, or Low |
| Category | Type of activity detected, such as C2, UEBA, Caution, Exfiltration, or Discovery |
See Detection Details for the signals that contribute to the risk score.