EDR dashboard
You can access detailed analytics for Endpoint Detection and Response (EDR), including event detections by severity, type, and operating system. You'll find agent health information and a breakdown of MITRE tactics and techniques. The enhanced dashboards improve endpoint visibility, help analyze detection trends, and support operational readiness across managed EDR tools.
To access this dashboard from the Kyndryl Bridge main menu, go to Services → Kyndryl Services →Security & Resiliency → Security Operations Center and click the EDR tab.
Main dashboard
- EDR Data Source: A horizontal bar chart shows the number of security events from each managed EDR (Endpoint Detection and Response) tool.
- Detection Count: This metric displays the total number of security events identified across all managed EDR tools, highlighting detection capabilities.
- Detections by Severity: A horizontal bar chart categorizes security events by severity levels (Low, Medium, High, Critical, Informational, and Under Evaluation).
- Detection Type: This horizontal bar chart presents the count of security events organized by type, including alert, malware, suspicious activity, and policy violation.
- EDR Detection by OS: A horizontal bar chart shows the count of events detected, categorized by operating systems.
- Top 10 Tactics: A map visualizes the top ten detection tactics, showing their corresponding MITRE tactic percentages to identify prevalent attack methods.
- Detections Over Time: A line chart tracks the number of security event detections over time, revealing trends and fluctuations in incidents.
- Agent Health: A vertical bar chart displays the distribution of agents by health status: Active, Online, or Offline.
EDR alert detail dashboard
- Detection Status: A horizontal bar chart shows the count of security events by their current status.
- Detection Severity: A horizontal bar chart displays the number of security events categorized by severity levels: Low, Medium, High, Critical, Informational, and Under Evaluation.
- Technique Level Breakdown: A map shows the distribution of security event detections based on the percentage of MITRE techniques used.
- Data table: It displays important information about each alert from all managed EDR tools, including Type, Event ID, Source, Timestamp, Severity, Status, MITRE Tactic, MITRE Technique, Host Name, IP Address, and Operating System.
EDR endpoint detail dashboard
- Agent Health: A vertical bar chart displays the number of agents categorized by status: Active, Online, and Offline.
- Unique Endpoints by OS: A vertical bar chart shows the count of unique endpoints organized by their operating systems, highlighting the distribution of OS environments in the network.
- Data Table: This section features a data table detailing key information for each scanned host across managed EDR tools, including Source, Host Name, and Operating System (OS) for easy reference.