Alert Analysis Dashboard

The Alert Analysis Dashboard shows you an overview of the alerts in your environment. You can find it by going to Dashboards > Alert Analysis.

By default, you will see the past 30 days of data for both the dashboard funnel and the data within each integration. You can change the timeframe using the dropdown menu at the top right.

Notice

As of August 1, 2024, the Alerts Analysis Dashboard shows the total number of raw events ingested from all of your integrations. This number more accurately reflects the true volume of data Expel receives and processes from customer environments for use in threat detection and investigation. Some existing customers may notice a significant change in the event volume reflected.

What caused this significant change?

In prior versions, the “Source Alerts And Events Analyzed” number on the far left of the funnel represented a combination of third-party security alerts and an aggregation of data generated by Expel for certain integrations. We heard your feedback that this was confusing, and it made it difficult to understand how much data you were sending to Expel.

In the new model, we count the grand total of Raw Events Ingested, which includes third-party alerts and all event telemetry that Expel processes and analyzes. As a result of this change, customers with certain integrations can expect to see major increases following the change. For example, technologies such as Microsoft365 (M365) and AWS CloudTrail generate a high volume of event telemetry but a low volume (if any) of security alerts. As such, M365 and AWS CloudTrail customers (among others) can expect a major difference between the old “Source Alerts And Events Analyzed” and the new “Raw Events Ingested.” Please know this is fully expected based on the changes to what data we are counting.

Understanding the Dashboard Funnel

The green flow at the top of the screen offers four data summaries.

Events Ingested

This count shows the total number of events we ingest from your connected security devices, including both security alerts and events.

The following is included in this count:

• alerts

• events

• logs

The count presented here may not match one-to-one with your device’s console. This is expected, because Expel only ingests relevant security data curated by our Detection and Response team.

Expel Alerts

Expel Alerts are triggered by incoming events and appear in Workbench for analysts to triage, investigate, and respond to.

Investigations From Expel Alerts

An Expel Alert becomes an Investigation if a SOC Analyst determines that more in-depth analysis of the activity is needed. The Expel Alert that raised suspicion becomes the “lead Expel Alert”.

During Investigations, SOC Analysts can perform Investigative Actions to uncover more information to help determine the scope and nature of the activity that occurred proximate to the time of the Expel Alert.

Incidents From Expel Alerts

If the SOC Analysts determine there is a threat in an organization’s environment, an Investigation is flagged as an Incident. Incidents are similar to Investigations in that they include Investigative Actions and have a similar look and feel. Incidents, however, include Findings.

Integrations by Category

Active integrations display by default.

You can select any of an integration's gray boxes (Events Ingested, Expel Alerts, Lead Alerts, Timeline Activity) to get more information. The chosen box will be indicated with a green bar along the bottom.

Active Integrations

This view provides an overview of all of your integrations that are currently active within Workbench, and that generated an Expel Alert within the timeframe selected at the top of the page.

Integration Totals

This view is the total number of events, Expel Alerts, Investigations, and Incidents within the timeframe selected at the top of the page. It offers an overview of how your technologies are contributing to Expel detections at an aggregated level.

Integrations with No Expel Alerts

This view shows all integrations that have not contributed to an Expel Alert within the timeframe selected at the top of the page. You can use this view to understand which technologies may need some tuning.

Search by GUID

This view allows you to search your onboarded integrations for a particular security device GUID.