Insights

Overview

Insights is a dashboard of key hunting metrics for your organization. The current Insights give you visibility into the volume and changes in signals in your environment to inspire new hunts. As well as metrics, the Insights page also provides an update of the most recent Detection Rules and File Creation anomaly events. The Detection Rule list shows how Nebulock is enabling coverage on emerging threats, while the File Creation anomalies identify potential insider activity on hosts.

Insights Summary

The Insights summary provides a high level view of the status and usage of the platform. This section is time derived and can be adjusted using the drop down picker at the top right of the page. The default view is the past 90 days, with the ability to change to the past 30 days.

• Signals: The total number of signals generated by detection rules in the platform.
• Vibe Hunts: The total number of vibe hunts executed in your Nebulock platform across all users.
• Findings: The total number of Findings created from signals by the Nebulock platform.
• Active Detection Rules: The total number of deployed detection rules, both customer created and Nebulock created, in the platform.

Activity Overview

The Activity Overview graph breaks the above data points down further, showing a daily tally of each category. Users can see their vibe hunts created over time, as well as how frequently rules are deployed or findings are generated from signals within their environment. Note: This section is also impacted by the date picker.

Signals Volume

The Signals Volume graph enables Nebulock users to quickly identify unexpected issues, like a sudden drop or spike in Signals that might indicate a data issue or a recently deployed rule that is too noisy. Note: This section is also impacted by the date picker.

Latest Nebulock Detection Rules

This section displays a list of detection rules created by the Nebulock Detection Engineering team. Each rule contains the corresponding MITRE ATT&CK ID by T-number, as well as a brief title describing what behavior(s) the rule will identify. This list allows you to understand current detection coverage provided by the Nebulock team and focus on hunting new and emerging threats.