Accessing Insights of User, Host, and Generic Entity Groups

Viewing the Summary Tab of User Entity Groups

Use this procedure to access and understand the Summary tab of user entities within an entity group.

To access the Summary tab in entity groups:

1. Navigate to Resolutions → Overview under the Entities section. The Entities Overview page appears.
2. Click the Groups tab to view the list of existing entity groups.
3. Select the user entity group whose summary or dashboards you want to view. This opens the Summary tab by default. This tab provides key insights into the behavior and profile distribution of user entities within the selected entity group.

Total Users
Displays the total number of users—both associated and disassociated—linked to the entity group in the last 7 days. Click the user count to view all user entities grouped under the user entity group. You can also click on Associated Entities to view more details. Association and disassociation are determined based on the conditions defined in the entity group.

Users by Organizational Unit
Displays a breakdown of users by their organizational units within the entity group. Click the count next to each unit to view the corresponding user entities.

Users by Office Location
Categorizes users in the entity group based on their office location. Click the count next to each location to see how many users are associated with that office.

Users by Role
Groups users in the entity group according to their assigned roles. Click the count next to each role to see how many user entities are mapped to that role.

Users by Employment Type
Displays users in the entity group based on their employment type, such as full-time, contractor, etc. Click the count next to each type to view the corresponding user entities.

Behaviors Overview
Summarizes all observed behaviors (MITRE tactics and techniques) exhibited by users in the entity group. It includes:

• The number of users displaying risky behaviors aligned with MITRE tactics and techniques
• The total number of signals generated due to these behaviors

When you hover over users, a behavior summary appears, displaying the detection rules that triggered occurrences from the users (entities). You can view the list of entities(users) that exhibited specific behaviors and the total number of signals (occurrences) raised collectively from entity users for each behavior.

User Activity Insights

Provides a detailed view of risky behaviors exhibited by individual users. It includes:

• Mapping adversarial user behaviors to MITRE tactics and techniques
• The total number of signals raised for each behavior exhibited by a user entity

When you hover over occurrences, a summary displays the total number of signals (occurrences) generated by a specific entity (user), along with a breakdown by behavior category.

ActOn Closure Reason

Displays the total number of ActOns created from signals and their respective closure reasons.

Security Activities
Presents a funnel view that illustrates the transition of signals into situations and then into ActOns for users in the group.

Signals
This section lists signals raised based on behavioral patterns identified within the entity group. By default, data is displayed for the last 30 days, but you can adjust the date range from 24 hours up to 90 days. The available presets include: Last 24 hours, Last 7 days, Last 15 days, Last 30 days, Last 60 days, and Last 90 days.

When you hover over any data point in the graph, a tool tip appears showing the total number of signals raised on that specific date. It also displays the detection rules that triggered the signals, the behaviors exhibited by the entities (users), and the sources from which the signals originated. You can click the Analyse Signals link to explore the signals in more detail.

Situations vs ActOns
Compares the number of situations and ActOns generated in the last 30 days, displayed by date. The date range is adjustable from 24 hours to 90 days. When you hover over any data point in the graph, a summary appears showing the ActOns and Situations created on that date, along with the detection rules that triggered the Situations and the ActOn policies that converted those Situations into ActOns. There is a link to navigate to the Situations and ActOns listing page for deeper analysis. 

Viewing Total and Categorized Entities in the User Entity Group

Use this procedure to view the list of entities that belong to a user-specific entity group based on its binding conditions.

The following widgets support drill-downs to view the entities that fall under each category:

• Total Users
• Users by Organizational Unit
• Users by Office Location
• Users by Role
• Users by Employment Type

To access the user entities list:

1. Navigate to Resolutions → Overview under the Entities section. The Entities Overview page appears.
2. Click the Groups tab to view existing entity groups.
3. Select a user group, then click the count next to any of the following widgets to view the entities that fall under each category. The list of entities within the selected group will be displayed.
   • Total Users
   • Users by Organizational Unit
   • Users by Office Location
   • Users by Role
   • Users by Employment Type
4. Review the details of user entities. The following information applies specifically to entities in the User entity group.

Viewing the Summary Tab of Host Entity Groups

Use the following steps to access and understand the Summary tab of host entities within an entity group.

To access the Summary Tab:

1. Navigate to Resolutions → Overview under the Entities section.
   The Entities Overview page appears.
2. Click the Groups tab to view the list of existing entity groups.
3. Select a host entity group to view its details.
   The Summary tab opens by default. This offers a comprehensive view of host behaviors, attributes, and security insights for the selected entity group.

Total Hosts

Displays the total number of hosts—both associated and disassociated—linked to the entity group in the last 7 days.

Ingested Sources

Presents a bar graph showing the number of entities ingested from each source.

Hosts by Location

Categorizes hosts within the entity group based on their geographic location.

Hosts by Environment & POD

Groups hosts by their environment (e.g., production, development) and Point of Delivery (POD).

Hosts by Platform

Displays the distribution of hosts based on their platform (e.g., Windows, Linux).

Hosts by State

Shows the number of active and inactive hosts in the entity group.

Behaviors Overview

Summarizes observed behaviors mapped to MITRE tactics and techniques. This includes:

• Number of users exhibiting risky behaviors
• Total signals generated due to these behaviors

When you hover over hosts, a behavior summary appears, displaying the detection rules that triggered occurrences from the host entities. You can view the list of host entities that exhibited specific behaviors and the total number of signals (occurrences) raised collectively from hosts for each behavior.

Host Activity Insights

Provides behavior-level insights per host, including:

• Mapping of adversarial behaviors to MITRE tactics and techniques
• Signal count per behavior for each host entity

When you hover over occurrences, a summary displays the total number of signals (occurrences) generated by a specific host entity, along with a breakdown by behavior category.

Exposures and Weaknesses

Highlights vulnerabilities and exposures identified in the hosts.

ActOn Closure Reason

Displays the number of ActOns created from signals and their respective closure reasons.

Security activities

Presents a funnel view that illustrates the transition of signals into situations and then into ActOns for users in the group.

Signals

Lists behavior-based signals raised in the last 30 days by default. The date range can be adjusted between 24 hours and 90 days.

When you hover over any data point in the graph, a tool tip appears showing the total number of signals raised on that specific date. It also displays the detection rules that triggered the signals, the behaviors exhibited by hosts, and the sources from which the signals originated. You can click the Analyse Signals link to explore the signals in more detail.

Situations vs ActOns

Compares the number of Situations and ActOns generated over time. The date range can be adjusted between 24 hours and 90 days.

When you hover over any data point in the graph, a summary appears showing the ActOns and Situations created on that date, along with the detection rules that triggered the Situations and the ActOn policies that converted those Situations into ActOns. There is a link to navigate to the Situations and ActOns listing page for deeper analysis. 

Viewing Total and Categorized Entities in the Host Entity Group

Use this procedure to view the list of entities that belong to a host-specific entity group based on its binding conditions.

The following widgets support drill-downs to view the entities that fall under each category:

• Total Hosts
• Ingested Sources
• Hosts by Location
• Hosts by Environment & POD
• Hosts by Platform
• Hosts by State

To access the host entities list:

1. Navigate to Resolutions → Overview under the Entities section. The Entities Overview page appears.
2. Click the Groups tab to view existing entity groups.
3. Select a host group, then click the count next to any of the following widgets to view the entities that fall under each category. The list of entities within the selected group will be displayed.
   • Total Hosts
   • Ingested Sources
   • Hosts by Location
   • Hosts by Environment & POD
   • Hosts by Platform
   • Hosts by State
4. Review the details of host entities. The following information applies specifically to entities in the host entity group.

Other options:

• Use the search box to search by name.
• Select or deselect columns to display in the table using the table settings icon.

Viewing the Summary Tab of Generic Entity Groups

Use the following steps to access and understand the Summary tab of entities within a generic entity group.

To access the Summary Tab:

1. Navigate to Resolutions → Overview under the Entities section.
   The Entities Overview page appears.
2. Click the Groups tab to view the list of existing entity groups.
3. Select a host entity group to view its details.
   The Summary tab opens by default. This offers a comprehensive view of behaviors, attributes, and security insights for the selected generic entity group.

Total Entities

Displays the total number of hosts—both associated and disassociated—linked to the entity group in the last 7 days.

Entities by Organizational Unit
Displays a breakdown of entities by their organizational units within the entity group. Click the count next to each unit to view the corresponding user entities.

Entities by Office Location
Categorizes entities in the entity group based on their office location. Click the count next to each location to see how many users are associated with that office.

Behaviors

Summarizes observed behaviors mapped to MITRE tactics and techniques.
Includes:

• Number of users exhibiting risky behaviors
• Total signals generated due to these behaviors

When you hover over entities, a behavior summary appears, displaying the detection rules that triggered occurrences from the entities. You can view the list of entities that exhibited specific behaviors and the total number of signals (occurrences) raised collectively from entities for each behavior.

Activity Insights

Provides behavior-level insights per entity, including:

• Mapping of adversarial behaviors to MITRE tactics and techniques
• Signal count per behavior for each entity

When you hover over occurrences, a summary displays the total number of signals (occurrences) generated by a specific entity, along with a breakdown by behavior category.

ActOn Closure Reason

Displays the number of ActOns created from signals and their respective closure reasons.

Security activities

Presents a funnel view that illustrates the transition of signals into situations and then into ActOns for users in the group.

Signals

Lists behavior-based signals raised in the last 30 days by default. The date range can be adjusted between 24 hours and 90 days.

When you hover over any data point in the graph, a tool tip appears showing the total number of signals raised on that specific date. It also displays the detection rules that triggered the signals, the behaviors exhibited by hosts, and the sources from which the signals originated. You can click the Analyse Signals link to explore the signals in more detail.

Situations vs ActOns

Compares the number of Situations and ActOns generated over time. The date range can be adjusted between 24 hours and 90 days.

When you hover over any data point in the graph, a summary appears showing the ActOns and Situations created on that date, along with the detection rules that triggered the Situations and the ActOn policies that converted those Situations into ActOns. There is a link to navigate to the Situations and ActOns listing page for deeper analysis. 

Viewing Total and Categorized Entities in the Generic Entity Group

Use this procedure to view the list of entities that belong to a generic entity group based on its binding conditions.

The following widgets support drill-downs to view the entities that fall under each category:

• Total entities
• Entities by organization unit
• Entities by office location

To access the entities list:

1. Navigate to Resolutions → Overview under the Entities section. The Entities Overview page appears.
2. Click the Groups tab to view existing entity groups.
3. Select a generic entity group, then click the count next to any of the following widgets to view the entities that fall under each category. The list of entities within the selected group will be displayed.
   • Total entities
   • Entities by organization unit
   • Entities by office location
4. Review the details of entities. The following information applies specifically to entities in the generic entity group in the side sheet. 

Other options:

• Use the search box to search by name.
• Select or deselect columns to display in the table using the table settings icon.