SIEM (HIDS) Dashboard Overview

The SIEM (HIDS) dashboard provides a centralized view of Host-based Intrusion Detection System (HIDS) alerts and monitored assets. 

Filter by agent and time period

The SIEM dashboard (HIDS) include a filter panel on the right-hand side, allowing to narrow down data based on specific agents and time periods.

Alerts Chart:
Visual representation of alerts over time per device, enabling pattern recognition and quick issue identification. 

Top Tactics

• Displays the most frequently used MITRE ATT&CK tactics associated with detected threats.

• Helps security teams identify common attacker behaviors.

MITRE Techniques by Agent

• Visualizes which MITRE ATT&CK techniques were triggered, grouped by agent.

• Useful for agent-level threat mapping and response planning.

Vulnerability

• Four separate cards represent the number of vulnerabilities detected, categorized by severity:

  • Critical Vulnerabilities

  • High Vulnerabilities

  • Medium Vulnerabilities

  • Low Vulnerabilities

• These indicators help prioritize remediation based on risk impact.

4. Alert Level Evolution (Graph)

• Shows a time-based area chart of alerts categorized by severity levels.

• Allows tracking of alert volume trends over time.

MITRE Panels (Top Tactics & Attacks by Technique)

• Reserved panels for future display of attack tactics and techniques per MITRE ATT&CK mapping.

• Useful for classifying and understanding attacker goals and methods when data is available.

Registry Activity Counters

• Displays the count of key registry-related actions that may indicate suspicious behavior:

  • Registry Value Entry Deleted

  • Registry Key Entry Added

  • Registry Key Deleted

  • Host Anomaly Detection

  • Remote Desktop Connected

  • Remote Desktop Disconnected
    These counters help identify unauthorized or unusual modifications to the system registry and remote session activity.

MITRE Attack Logs

• A tabular view of detected attack events with the following details:

  • Time – When the event occurred

  • Agent Name – Identifier for the host agent

  • Agent IP – IP address of the affected system

  • Tactic – MITRE tactic (currently not populated)

  • Description – Explanation of the detected action (e.g., logon failure)

  • Level – Severity level of the detection

This log enables SOC teams to track endpoint-level attack patterns and respond to behavioral anomalies promptly.