Dashboard
What each card and panel on the dashboard shows, how the numbers are counted, and what to do when the dashboard is empty.
What the dashboard is
The dashboard is the first page you see after signing in, and a read-only summary of everything EyalSec has recorded on your account. Open it any time from Dashboard at the top of the left sidebar.
It changes nothing: to look at individual events, open Events; to change what is detected, use Configure or Filters.
Cards and panels
The dashboard is made of four number cards along the top, a 14-day chart, and four panels below it. Every figure covers your whole account: all machines and all products together, including suppressed events. Test events sent by eyalsec selftest are left out.
Counts are detections: each time an event happens counts once, so an event that repeated 40 times adds 40, the same number as its count on the Events page.
Total Detections
Total Detections (subtitle all time hits) is how many detections have been recorded on your account, across every machine and product, since your first event. Deleting a machine removes its events from this total.
Unique Event Types
Unique Event Types (subtitle distinct event names) is how many different kinds of event you have seen, counted by the place each event happened: its sink label, such as os.system or sqlite3.execute. Many events of the same kind count once.
Last 24 h and Last 7 d
Last 24 h and Last 7 d count the detections in events first recorded in the last 24 hours and the last 7 days. They tell you at a glance whether something new is happening right now.
These windows go by when each event was first recorded. A repeat of an event first seen a month ago adds to Total Detections and to that event's count, but not to Last 24 h, so a jump here means new kinds of events rather than more of the old ones.
Detections: last 14 days
Detections: last 14 days is a bar chart with one bar per day for the last two weeks, oldest on the left. Hover over a bar to see the date and the number. Days are calendar days in UTC, and like the cards above, each event's detections are placed on the day it was first recorded.
Top Events by Count
Top Events by Count lists the ten event types (sink labels) with the most detections, highest first, with a bar showing each one against the top entry. It shows where most of your noise, or most of your risk, is coming from.
Recent Activity
Recent Activity lists the ten events that were first recorded most recently, newest first. An old event that keeps repeating does not come back to the top of this list. Each line shows when the event was first recorded (in your display time zone), its sink label and its count so far, as ×12.
This panel is about detected events. What you did on your account (sign-ins, machine changes) is in the Activity log.
Event Type Breakdown
Event Type Breakdown shows how the top eight event types split between them, each with a colored bar and a percentage. The percentages are shares of those eight together, not of all your detections, so they always add up to about 100% even when you have many more types.
Stats at a Glance
Stats at a Glance collects the headline numbers in one list:
| Row | What it shows |
|---|---|
| First detection | the date of your earliest recorded event |
| Latest detection | the date of your most recently recorded event |
| Avg detections / day | all-time detections divided by the days between the first and latest detection |
| Last 1 h | detections in events first recorded in the last hour |
| Last 24 h | the same for the last 24 hours |
| Last 7 d | the same for the last 7 days |
| Total all-time hits | the same number as Total Detections |
A dash (-) means there are no events yet.
When the numbers update
The dashboard reads its numbers once, when the page loads; it does not refresh on its own. The time next to the Dashboard title (updated 14:03:22) is when that happened. Reload the page for newer figures.
The numbers themselves can be up to about 30 seconds behind the newest events. While they load, the page shows grey outlines of its panels. If the page cannot reach the server, it shows "Could not load the dashboard." with a Retry button.
Setup checklist
Until es-python has sent its first event, the top of the dashboard shows a short checklist: Account, Plan, Machine added, Installed, Sources on and First event. Each step ticks itself as soon as it is done, without reloading the page, and the next step to do has one button that does it:
| Step | The button |
|---|---|
| Plan | Book a live demo, to get a plan set up for your account. |
| Machine added | A name field and Add, which adds an es-python machine. |
| Installed | Show install command, which shows the one-line install command for that machine with a Copy button. Run it on the machine. |
| Sources on | Watch network input and file reads, which switches the socket and file sources On for every machine on your account. You can change them later in Filters. |
| First event | Shows eyalsec selftest with a Copy button. Run it on the machine to send a harmless test event, or run your own program with es-python. |
When every step is done, the checklist shrinks to a single Setup complete line, which you can dismiss. The same information is available from the API as GET /api/onboarding_state/.
Add your first machine
Until your account has a machine, the dashboard starts with a box titled Add your first machine to start detecting. Add a machine takes you to the Machines page, and Read the quick start opens the Quick start.
The box goes away once you have added a machine. An account with es-python sees the setup checklist instead.
Empty dashboard
A dashboard full of zeros and "No data" means no events have been recorded yet. The usual reasons are that the machine is not installed yet, that no taint source your program uses is switched on (a machine you add starts with only socket and file on), or that your program is not running under the EyalSec product.
Check that the machine shows installed on the Machines page, switch sources on in Configure, and see No events for more.