Skip to main content

User Investigation Dashboard

The User Investigation dashboard only appears when you conduct a search. You can do this by clicking a user-account hyperlink in the Perpetrator or Affected Object columns of a table card. Alternatively, enter the complete user name in the Search box on the right side of the navigation bar.

The User Investigation dashboard contains the following cards:

User Investigation Dashboard

  • Total Actions – Number of all events associated with the user over the specified time interval
  • Source Hosts – Number of source IP addresses associated with the user over the specified time interval
  • Destination Hosts – Number of destination IP addresses associated with the user over the specified time interval
  • Activity – Timeline of all events associated with the user over the specified time interval. See the Graph Card Features topic for additional information.
  • Latest Events – Tabular format of all events associated with the user over the specified time interval. See the Table Card Features topic for additional information.
  • Offenses Related to User – QRadar offenses associated with the user during the specified time interval. See the Table Card Features topic for additional information.

The time interval is identified in the upper-right corner with the Start and End boxes. This defaults to the past three (3) hours. To search within a different interval, either manually enter the date and time you want or use the calendar buttons to set them interval. Then click Search to refresh the card data.

When you instigate a search using a time interval longer than twelve (12) hours, the app breaks the database query into multiple mini-queries. This visibly resets the dashboard display at the end of each mini-query until the app has retrieved all data for the selected time interval.

Additionally, use this feature to scope the report data to just Threat Prevention collected events or to all information in QRadar for the selected user, which opens in another tab. Click Search and select Threat Prevention from the dropdown menu to refresh the card data or select QRadar from the dropdown menu to open the user’s List of Events.