> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-reference/dashboards/alert-analysis-dashboard.md).

# Alert Analysis Dashboard

The Alert Analysis Dashboard shows you an overview of the alerts in your environment. You can find it by going to **Dashboards > Alert Analysis**.

<figure><img src="/files/oFBNcbphQT5X2wHJKOUM" alt="Image of the Alert Analysis dashboard for an example customer, with identifying information removed.."><figcaption></figcaption></figure>

By default, you will see the past 30 days of data for both the [dashboard funnel](#understanding-the-dashboard-funnel) and the [data within each integration](#integrations-by-category). You can change the timeframe using the dropdown menu at the top right.

<div align="left"><figure><img src="/files/C0BHfWW3pLnR4FaGTTE3" alt="Image showing the dropdown at the top right, to allow you to change the timeframe." width="375"><figcaption></figcaption></figure></div>

{% hint style="info" %}

## Notice

As of August 1, 2024, the Alerts Analysis Dashboard shows the total number of raw events ingested from all of your integrations. This number more accurately reflects the true volume of data Expel receives and processes from customer environments for use in threat detection and investigation. Some existing customers may notice a significant change in the event volume reflected.

**What caused this significant change?**

In prior versions, the “Source Alerts And Events Analyzed” number on the far left of the funnel represented a combination of third-party security alerts and an aggregation of data generated by Expel for certain integrations. We heard your feedback that this was confusing, and it made it difficult to understand how much data you were sending to Expel.

In the new model, we count the grand total of Raw Events Ingested, which includes third-party alerts and all event telemetry that Expel processes and analyzes. As a result of this change, customers with certain integrations can expect to see major increases following the change. For example, technologies such as Microsoft365 (M365) and AWS CloudTrail generate a high volume of event telemetry but a low volume (if any) of security alerts. As such, M365 and AWS CloudTrail customers (among others) can expect a major difference between the old “Source Alerts And Events Analyzed” and the new “Raw Events Ingested.” Please know this is fully expected based on the changes to what data we are counting.
{% endhint %}

## Understanding the Dashboard Funnel

The green flow at the top of the screen offers four data summaries.

<details>

<summary>Events Ingested</summary>

This count shows the total number of events we ingest from your connected security devices, including both security alerts and events.

The following is included in this count:

* alerts
* events
* logs

{% hint style="warning" %}
The count presented here may not match one-to-one with your device’s console. This is expected, because Expel only ingests relevant security data curated by our Detection and Response team.
{% endhint %}

</details>

<details>

<summary>Expel Alerts</summary>

[Expel Alerts](/workbench-reference/alerts/how-expel-alerts-work.md) are triggered by incoming events and appear in Workbench for analysts to triage, investigate, and respond to.

</details>

<details>

<summary>Investigations From Expel Alerts</summary>

An Expel Alert becomes an [Investigation](/workbench-reference/investigations-and-incidents/understanding-investigations.md) if a SOC Analyst determines that more in-depth analysis of the activity is needed. The Expel Alert that raised suspicion becomes the “lead Expel Alert”.&#x20;

During Investigations, SOC Analysts can perform [Investigative Actions](/workbench-reference/expel-terminology.md#investigative-action) to uncover more information to help determine the scope and nature of the activity that occurred proximate to the time of the Expel Alert.&#x20;

</details>

<details>

<summary>Incidents From Expel Alerts</summary>

If the SOC Analysts determine there is a threat in an organization’s environment, an Investigation is flagged as an [Incident](/workbench-reference/investigations-and-incidents/understanding-incidents.md). Incidents are similar to Investigations in that they include [Investigative Actions](/workbench-reference/expel-terminology.md#investigative-action) and have a similar look and feel. Incidents, however, include [Findings](/workbench-reference/expel-terminology.md#finding).&#x20;

</details>

## Integrations by Category

Active integrations display by default.&#x20;

<div align="left"><figure><img src="/files/Kc1IWe3A1nLWkfCaB2kF" alt=""><figcaption></figcaption></figure></div>

{% hint style="info" %}
You can select any of an integration's gray boxes (Events Ingested, Expel Alerts, Lead Alerts, Timeline Activity) to get more information. The chosen box will be indicated with a green bar along the bottom.
{% endhint %}

<details>

<summary>Active Integrations</summary>

This view provides an overview of all of your integrations that are currently active within Workbench, and that generated an [Expel Alert](/workbench-reference/alerts/how-expel-alerts-work.md) within the timeframe selected at the top of the page.

<figure><img src="/files/id0Se1gYPLAJXM3Hkaya" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>Integration Totals</summary>

This view is the total number of events, [Expel Alerts](/workbench-reference/alerts/how-expel-alerts-work.md), [Investigations](/workbench-reference/investigations-and-incidents/understanding-investigations.md), and [Incidents](/workbench-reference/investigations-and-incidents/understanding-incidents.md) within the timeframe selected at the top of the page. It offers an overview of how your technologies are contributing to Expel [detections](/workbench-reference/detections/about-detection-strategy.md) at an aggregated level.

</details>

<details>

<summary>Integrations with No Expel Alerts</summary>

This view shows all integrations that have not contributed to an [Expel Alert](/workbench-reference/alerts/how-expel-alerts-work.md) within the timeframe selected at the top of the page. You can use this view to understand which technologies may need some tuning.

</details>

<details>

<summary>Search by GUID</summary>

This view allows you to search your onboarded integrations for a particular security device GUID.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-reference/dashboards/alert-analysis-dashboard.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.