SIEM dashboard
This dashboard offers analytics on SIEM data sources, detections, storage usage, and logs. It improves visibility into event severity, detection trends, and system health, aiding in quicker incident triage and informed security management.
To access this dashboard from the Kyndryl Bridge main menu, go to Services → Kyndryl Services →Security & Resiliency → Security Operations Center and click the SIEM tab.
Main dashboard
This streamlined approach to SIEM data analysis provides essential insights for improving security measures and response planning.
- SIEM Data Sources: A bar chart shows event counts for each managed SIEM tool for performance comparison.
- Detection Count: Total potential security incidents detected by all managed SIEM tools, reflecting the overall security posture.
- Total Storage Usage: Displays total storage used by all SIEM tools for assessing resource efficiency.
- Unique Source Count: Total count of unique log sources monitored, indicating data diversity.
- Detection Status: A bar chart shows event counts by status for assessing detected incident states.
- Detections by Severity: A bar chart reveals event counts by severity levels—Low, Medium, High, and Critical—highlighting urgent areas.
- Last Log by Host: Bar chart displays last log times from hosts in 24-hour intervals to monitor activity and anomalies.
- Last Log by Non-Host: Similar bar chart for non-host devices, showing last log times in 24-hour intervals for a complete activity view.
- SIEM Detections by Day: A line chart tracks detection counts over time for trend analysis and strategy development.
- Tactic Level Breakdown: A map shows the percentage of detections categorized by MITRE tactic for understanding detected incident tactics.
SIEM alert dashboard
- Detection Status: Vertical bar chart showing event counts by status.
- Detections by Severity: Horizontal bar chart displaying event counts by severity levels: Low, Medium, High, and Critical.
- Tactic Level Breakdown: Map showing the percentage of SIEM detections by MITRE tactic.
- Detection Details: Data table with detailed information on security event detections, including ID, Source, Related Incident Number, Generated Time, Start Time, Detection Duration (hours), Severity, Status, and Title.
SIEM storage detail dashboard
The table offers comprehensive details regarding each storage device recognized by the SIEM tools in management, including the name of the storage item and the amount of storage utilized (measured in GB). The vertical bar chart presents the top 10 storage items ranked by percentage usage (in GB), illustrating the total allocated storage size for different operating systems. This visual representation enables an easy comparison of their respective capacities.
SIEM host detail dashboard
The monitoring system provides valuable insights into log activity across hosts.
- Last Log by Host: This section features a vertical bar chart that illustrates the most recent log sent to the Security Information and Event Management (SIEM) system by each individual host. The data is organized into 24-hour intervals for clear visibility.
- Last Log Received by Host Name: A vertical bar chart showcases the ten most recent logs, sorted by host name, providing a quick overview of log activity associated with each host.
- Data Table: This table presents detailed information for each host monitored by the SIEM tools, including the following columns: Name, Operating System, First Log Received, Last Log Received, Current Date/Time, and Last Log Received (Hours), offering a comprehensive snapshot of host logging activity.
SIEM non-host detail dashboard
The report contains two main visualizations and a data table focused on log activity:
- Last Log by Host: A vertical bar chart showing the most recent log transmission times to the SIEM system by host devices, organized into 24-hour intervals.
- Last Log Received (Non-Host): A vertical bar chart displaying the ten most recent logs from non-host devices, enabling quick assessment of log activity.
Additionally, there is a detailed data table for each non-host device monitored by the SIEM. It includes columns for Workspace, Data Source, Date Ingested, Last Log Received, Current Date/Time, and Last Log Received Duration (in hours).SIEM Data Sources: A bar chart shows event counts for each managed SIEM tool for performance comparison.
- Detection Count: Total potential security incidents detected by all managed SIEM tools, reflecting the overall security posture.
- Total Storage Usage: Displays total storage used by all SIEM tools for assessing resource efficiency.
- Unique Source Count: Total count of unique log sources monitored, indicating data diversity.
- Detection Status: A bar chart shows event counts by status for assessing detected incident states.
- Detections by Severity: A bar chart reveals event counts by severity levels—Low, Medium, High, and Critical—highlighting urgent areas.
- Last Log by Host: Bar chart displays last log times from hosts in 24-hour intervals to monitor activity and anomalies.
- Last Log by Non-Host: Similar bar chart for non-host devices, showing last log times in 24-hour intervals for a complete activity view.
- SIEM Detections by Day: A line chart tracks detection counts over time for trend analysis and strategy development.
- Tactic Level Breakdown: A map shows the percentage of detections categorized by MITRE tactic for understanding detected incident tactics.