7.5 Analyzing Alert Dashboards

Alert dashboards allow you to analyze and study common patterns in alerts, such as:

  • Types of alerts

  • Average time owners take to close alerts

  • The correlation rule generating the maximum number of alerts

  • Geographical origin and destination of high-severity alerts

  • Oldest open alerts

  • Alerts that took the longest time to close

To view the alert dashboard:

  1. Log in to Sentinel and click the Alerts Dashboard.

  2. As you visualize and monitor alerts, you can perform the following activities in the alert dashboard:

    • Mouse over specific areas in the charts to view more information.

    • Select desired areas in the chart to filter the alert data. As you select a specific area in the chart, Sentinel filters the alerts in rest of the charts and tables in the dashboard. Click Filtering to remove the applied filters and go back to the unfiltered view.

  3. (Optional) You can customize the default view and save the dashboard. For information about customizing the dashboard, see Customizing the Alert Dashboard.

You can create custom charts and tables for analysis. You can filter and refine the data further as you select certain areas in the charts and use the query and filter options.

For example, you are a Security Operations Center manager in a multi-tenant environment, and you want to analyze and investigate alerts in detail and also understand how your team is handling the alerts. You can perform the following analysis in the alert dashboard:

  • Investigate Alerts: You can view the alerts generated over time, number of open alerts versus closed alerts, top correlation rules generating the most number of alerts, oldest open alerts, any spikes in alerts at a specific time range, and so on.

  • Monitor team performance:

    • The type of alerts the team has been working on

    • How the alert load is distributed among top owners

    • Time taken to close alerts of specific priorities

    • Find the team member owning the most number of alerts

    • Team members that took longest to investigate alerts

  • Monitor performance against tenant service-level agreement (SLA): You can view alerts from various tenants, analyze the most number of alerts from a specific tenant, time taken to investigate or close alerts for a specific tenant compared to other tenants, and so on.

The Alert dashboard provides a customizable and an easy-to-configure interface that helps you to view and investigate alerts in detail.

To create or view alerts in the dashboard, you must either be an administrator or have the permission to manage alerts. Depending on the alert permissions and the tenant you belong to, Sentinel displays the relevant alerts in the dashboard.

7.5.1 Analyzing Alerts

The Alert dashboard provides some pre-configured visualizations that provide information about alerts such as the following:

  • Overview: Displays a time series chart that shows alerts generated in Sentinel over time. You can inspect the time series charts for any spikes, which can indicate increase in attacks in your organization. You can drag and select the time period when the spike occurred to zoom into the alerts. As you select the specific time range, Sentinel filters the dashboard for alerts in the selected time range. Also, you can find out the geographical locations from where the alerts originated.

    To view geographical locations from where the alerts originated, ensure that the IpToCountry.csv file is populated by using the IP2Location Feed plug-in. For more information, see the IP2Location Feed documentation on the Sentinel Plug-ins Website.

  • Alert Load: Provides information about the alerts at a granular level such as the following:

    • Topmost alerts in your enterprise

    • Alert distribution among top alert owners

    • Total number of alerts in individual alert states

    • Number of alerts received from each tenant

    • Total number of alerts based on priority

  • Performance rows: Provides statistical information about how efficiently alerts are investigated and closed based on priority, correlation rule, alert owners, and tenants.

  • Details: Provides detailed alerts information such as the oldest open alerts, number of times the duplicate alerts were rolled up, and all alert fields.

The alert dashboard displays all alerts in your local Sentinel server. To view alerts from other Sentinel servers, you need to view the alerts in the Alert Views. For more information, see Creating an Alert View. The alert dashboard displays only distinct alerts. Duplicate alerts are rolled up to a single distinct alert. For more information about the rolling up of duplicate alerts, see Configuring Alert Creation in the Sentinel Administration Guide.

7.5.2 Customizing the Alert Dashboard

Sentinel leverages Kibana, a browser-based analytics and search dashboard, that helps you to visualize and analyze data. The dashboard is a collection of visualizations. You can modify or create new visualizations and dashboards with the data you want to visualize. For information about creating visualizations and dashboards, see Visualize and Dashboard section in Kibana documentation.

7.5.3 Searching Alerts

You can search for alerts in your Sentinel system by using the Discover option in Kibana. To search for alerts, select alerts.alerts as the Index Pattern. For more information, see Discover section in Kibana documentation.