Endpoint Detection Visualizations

Severity Resources & Threat Breakdown

The Severity Resources & Threat Breakdown report provides visualization broken by Severity and Threat Category for resources. Most inner group shows the severity; middle circle reflect the assets and severity; the outer circle show the Threat category.

1. In Nexus, hover over Threat Management on the left-side nav.

2. Click Log Search.

3. Then click Log Search tab on the top of the page.

   1. Wait for the SSO.

1. Click on Visualizations

   

2. Click the Create new visualization button.

   

3. In the New Visualization pop up, select the Pie visualization option.

   

4. Choose a source.

   

5. Log Search will refresh to display the query screen. From here, the visualization can be configured.

   

6. Click Add filter.

   

7. Populate the following filters (Case sensitive):

   Field	Operator	Value	Note
   type	is	carbon-black
   event.type	is one of	WATCHLIST, CB_ANALYTICS
   Data_type	Is	armor-security-logs
   event.severity	Is one of	8, 9, 10	Optional if you want to filter higher severities

8. Two buckets are needed to configure this visualization. Under Buckets, click the Add button, making sure to select split slices.

9. In the Aggregation drop down, select Terms.

10. In the Field box, enter "event.severity" or search for it.

11. Order by, Order and Size should all remain with their default values. Properly configured, the first bucket will look like the screenshot below:

    

12. To add the second bucket, click the Add button underneath Buckets, making sure to select split slices.

13. In the Sub aggregation dropdown, select Terms.

14. In the Field, enter "external_id" to select it. (External Id is the same as CoreInstanceId)

15. Order by, Order and Size will be set to default. Properly configured, the second bucket will look like the screenshot below:

    

16. To add the second bucket, click the Add button underneath Buckets, making sure to select split slices.

17. In the Sub aggregation dropdown, select Terms.

18. In the Field, enter "threat.blocked_threat_category" to select it.

19. Order by, Order and Size will be set to default. Properly configured, the second bucket will look like the screenshot below:

    

20. Optional step if you like to display labels, click Options tab:

    

21. When both buckets are configured, click the Apply Changes button.

    

22. Set the date range for the visualization.

    1. If the range encompasses more than one report, an additional filter with the report id can be added.

       

23. Save the visualization by clicking Save in the top left of the screen.

    

    Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.