Detections are organized based on the MITRE ATT&CK® framework.

• There are two bars for every detection activity:

  • The left bar will show detections from previous time period.

  • The right bar will show detections from current time period.

• The column names may differ depending on the coverage on each account,.

• Click the dates at the top of the widget to filter the chart by the previous and current weeks.

• Hover over the bars in the chart to view the discover counts.

• Click the bars in the chart to open the Detections Table. See, Detections Table.

Highlights observations (advanced correlations of multiple events by the FortiNDR Cloud backend.) Each observation will have different context variables that will show up.

• You can click the Observation Title to pivot to observation detail page.
• Click the bullet next to the observation name to filter the chart.
• Each column header is clickable.
• Hover over the data points in the graph to view detailed information about the observation.
• Click the items in the legend to hide or show lines in the chart.
• Use the Confidence dropdown to filter observations based on the confidence level (All, High, Moderate or Low).
• Under Observation Title, click the individual observation titles to view the observation detail page. See Observation detail page.

Highlights active rules with the highest severity and detection count.

Highlights investigations with the most recent activity.

• The table is sorted by Last Modified. Any investigations that are modified appear at the top.

• Click Investigations to open the Investigations page. See Investigations.

• Click an investigation name to open the Investigation Details page.

• Hover over Last Modified By or Name to view more information.