Threats dashboard

The Threats dashboard page provides a broad overview of your current security situation. By default, the dashboard shows data for the last seven days. You can select a different period of time for all widgets on the dashboard from the Show menu at the top of the page. For some individual widgets, you can change the time period from the Show menu in the widget, and export the widget as an image from the More Options menu in the widget. You can also hover over the More Info icon for a brief overview of some individual widgets.

Depending on the data available in Helix, the Threats dashboard shows the following information.

Widget	Description
Top 6 Threats	The alerts or correlations with the highest risk score. Alerts are threat vectors like someone clicking a malicious link. Correlations are created automatically, and are groups of alerts that have one or more data types in common, for example a malicious file. Click an alert name to get more details about the alert.
Total Risk Score	The severity of a threat and the time it occurred.
Assigned Threats	The number of alerts assigned to each user. You can filter the widget to show alerts, correlations, or both from the Threats menu.
Threat Intel Matches	Intel that matches the threat actor or indicator name. Data is displayed when intel alerts or correlations are triggered.
MITRE ATT&CK Matrix	The widget has two sections: Grid: The tactics and techniques that were used in attacks against your organization. You can expand the technique to view the number of threats associated with the technique. Circle chart: Each of the top four techniques has a color-coded arc in the chart. The fifth arc (Miscellaneous) represents all of the other techniques that were attempted. The legend includes the number of threats associated with each technique. You can hover over the Miscellaneous entry in the legend to see a list of the techniques in that category and the number of threats associated with each technique. To only see the tactics attempted in the selected period of time, turn on the Focused View toggle. To see all tactics that have been seen, but that were not attempted in the selected period of time, turn off the Focused View toggle. These tactics will display as grayed out.
Data Usage	Historical Data Usage: Shows the amount of data used over the past 12 months compared to your provisioned amount. Hover over the chart to see the data used for each month. Monthly Data Usage: Shows the amount of data used for the current month compared to your provisioned amount. Hover over the chart to see the percentage of data used and remaining.