Explore data through Dashboards

A dashboard is a collection of widgets that organize frequently used searches to view activities in the form of graphs and tables of relevant data. Dashboards are a convenient way to monitor events and explore data.

The home page provides quick access to some of the most popular dashboards – Security, Network Overview, and Security Posture – as tabs under the page title.

In addition, Investigator provides a set of pre-built Falcon LogScale (Humio) dashboards for common views corresponding to protocols, logs, or specific content collections and detections.

Hover the mouse over the Dashboard icon in the left navigation or click the More Dashboards tab on the home page to get started and see the landing page for all dashboards.

The Corelight packaged dashboards have both data-related dashboards and security-related dashboards.

The available dashboards include:

  • Anomaly Detection - First Seen – Identifies network entities and behaviors observed for the first time, highlighting potential indicators of new threats or changes in the environment.

  • Anomaly Detection Insights – Provides a high-level summary of deviations from baselined network activity, surfacing anomalous patterns across the environment.

  • Anomaly Detection Insights Details – Provides detailed analysis of individual anomalies, including baseline behavior and peer group comparisons.

  • Application Discovery – Identifies applications on the network using the app field in Corelight conn logs. Understand application usage patterns, detect GenAI tool adoption, identify large data transfers by application, and map connection geography.

  • Asset Classification – Visualizes Corelight automated network asset classification data, including device types, operating systems, brands, models, discovery sources, and confidence levels.

  • Asset Inventory – Provides details for internal and external assets, based on the Known Entity collection. Filters let you find assets by type.

  • AWS VPC Flow - IP Interrogation – Provides detailed IP-level analysis of AWS VPC Flow data for investigating specific IP address activity within virtual private cloud environments.

  • AWS VPC Flow - Overview – Visualizes AWS VPC Flow data captured by Corelight, providing a comprehensive overview of network traffic within a virtual private cloud.

  • Connections – Summarizes activity in conn logs, showing analytics of top hosts, services, ports, data transfers, and long-lived connections. The dashboard also includes health monitoring of potentially unavailable services.

  • Corelight Exec Overview – Provides a high level overview across multiple log sources summarizing top applications, usernames, websites, services, data transfer, and geographic information.

  • Corelight Health Report - Sensor Status – Displays all the sensors connected to Investigator and displays sensor status, including log types, connections, and event rates.

  • Corelight Suricata IDS Alert Overview – Overview of Suricata alerts, including details on volume of alerts over time and alert categories.

  • Corelight Traffic Health Indicators – Monitors key indicators of network traffic health, including connection states, retransmissions, and anomalies that may signal infrastructure issues or degraded network performance.

  • Device Inventory – Provides an inventory of devices observed on the network, including device classifications, operating systems, and associated network activity, helping analysts understand the asset landscape.

  • DNS – Summarizes host and query information in DNS logs, including details of top query types, reverse queries, queries with no response, queries to non-existent domains, and top hosts.

  • Entity Overview – Summarizes the network entities.

  • Files – Provides a summary of files log activity, including information on MIME types, file protocols, file flow, bytes sent and received, and executables.

  • HTTP – Provides a summary of HTTP log activity, including information on referrers, users, hosts, body length, user agents, host headers, originators, and status codes.

  • ICS/OT Monitoring – Provides asset and security insights for Industrial Control System and Operational Technology protocols, including OT device inventory, protocol usage, traffic anomalies, and protocol-specific function breakdowns.

  • Intel – Overview of intel logs, including volume over time, indicators, and summary of details.

  • IP Interrogation – Provides a summary of protocol usage, and information on top connections, services, user agents and ports from conn and http logs.

  • ISA IEC 62443 – Visualizes network traffic against ISA IEC 62443 controls to simplify compliance monitoring and identify risks in Industrial Control Systems (ICS).

  • Key Network Questions – Shows essential network information to answer important questions, including what network technologies are in use, what systems are providing core services/access services/file transfer services, plus bandwidth measurements and conversation tracking.

  • Known Entities – The Known entities logs (including known_users, known_hosts, and known_devices) extract and aggregate behavior for individual network entities. The Known Entities dashboard summarizes the entity behavior across all of the logs.

  • Lateral Movement Activity – Detects lateral movement via DCE/RPC and SMB protocols, surfacing suspicious RPC operations, admin share access, cross-protocol correlation, executable staging, and source fan-out patterns.

  • Log Hunting – Overview of log volume and data across all log sources.

  • Machine Learning Summary – Provides an overview of all machine learning models producing alerts, including model result output and detection counts.

  • Name Resolution Insights – Provides insight into DNS and name resolution activity to support SIEM analyst workflows, including top queried domains, resolution patterns, and anomalous lookup behavior.

  • Network Detection and Hunt – Surfaces detection data across multiple log sources to support proactive threat hunting and structured investigation of anomalous traffic patterns.

  • Network Hygiene – Identifies network hygiene issues such as cleartext protocol usage, expired or invalid certificates, and other configuration concerns that may represent risk or policy violations.

  • Network Performance Anomalies – Detects and tracks network performance degradation across DNS, TLS, QUIC, HTTP, and path latency dimensions, separating issues by whether the affected entity is inside or outside your network.

  • NIST SP800-52 – Analyzes SSL/TLS traffic to find insecure configurations, such as weak ciphers or old protocols, that violate NIST SP 800-52 guidelines.

  • Notices – Overview of Notices, including details on volume of alerts over time and alert categories.

  • Post-Quantum Cryptography (PQC) – Assesses organizational readiness for quantum-safe key exchange across SSH and TLS protocols, identifying which clients and servers support, offer, and actively negotiate post-quantum algorithms.

  • RDP Inferences Overview – Provides details inferred from authentication requests to the server in RDP connections. Details include inference type, inferences over time, successful/failed connections, security protocol, and details for connecting users.

  • Remote Activity Insights – Focuses on remote access monitoring, including RDP authentication attempts, VPN connections, and potential unauthorized access patterns and security violations.

  • Secure Channel Insights – Provides deep visibility into encrypted and non-encrypted SSL, SSH, TLS, and x509 traffic, monitoring potential security risks including weak certificates, outdated protocols, and suspicious behaviors.

  • Security Posture – Provides a high-level view of the organization’s security posture, summarizing detection activity, alert trends, and key risk indicators across the environment.

  • Shadow AI Detection – Provides visibility into enterprise GenAI tool adoption, shadow AI usage, and data-transfer risk, detecting unauthorized tool usage and potential data exfiltration through AI services.

  • SMB & DCE/RPC – Provides visibility into Windows file-sharing and remote procedure call activity, including file actions, share relationships, client/server mappings, and DCE/RPC operations and endpoints.

  • Software – Summarizes information in software logs, including a breakdown of top software by connection, and software versions and types.

  • SSH Inferences Overview – Provides details inferred from SSH login attempts. Details include inference type, inferences over time, HASSH fingerprint details, SSH host key, SSH authentication, SSH auth success, and inference log data.

  • SSL – Summarizes information from SSL and x509 logs, including details on ciphers, TLS versions and validation status, certificate summary, and certificate subjects.

  • Threat Hunting – Supports structured threat hunting across connection, TLS, DNS, files, protocol anomalies, and RDP data, with panel drilldowns to targeted searches for validation and incident response.

  • VPN Insights – Provides details of VPN protocol connections from the vpn log, including top VPN users and VPN types.

  • x509 – Summarizes information in x509 logs, including top and rare subjects and certificate expiration information.

Investigator also includes a set of dashboards with matches to the CrowdStrike Indicator of Compromise (IOC) database.

  • IOC - IP Overview – Displays an IOC dashboard based on IP addresses. The dashboard shows IOC geolocation, threat relationships, threat types, malware, actors, and kill chains.

  • IOC - Overview – Provides a summary of IOC activity and threat details, including threat by confidence, threat attributes, and severity over time.

Consult these Falcon LogScale (Humio) documentation topics to learn more about how to work with and manage dashboards.

Tip

If you frequently use a dashboard, click the star to the left of the dashboard name to mark it as a favorite. Favorites appear at the top of the list.

Create a new dashboard

You can create a new dashboard to match your preferences.

  1. From the Overview page, click More Dashboards.

  2. Click the + New dashboard button.

  3. In the New Dashboard dialog box, choose how to create the dashboard:

    • Empty Dashboard — start from scratch and create an empty blank dashboard. This is the default option, and you are prompted to provide only the name for the dashboard.

    • Duplicate Existing — create a copy of an existing dashboard. You are prompted to pick the dashboard you want to copy.

    • From Template — create a dashboard based on a template generated from another dashboard. You need to drag-and-drop a file or browse your computer to provide the template.

    • From Package — invoke dashboard templates that are part of LogScale packages, provided that such packages are installed in the repository where you want to create the dashboard. For more information on how to install a package and access a package template, see the LogScale documentation for Packages.

  4. Click Create.