4/6/24, 2:59 p.m.
Mod4B_Ex2_Review the built-in correlation rules dashboard
Steps Manage Correlation Rules
1
Review the built-in correlation rules dashboard
6
10
In this exercise, you’ll explore the built-in correlation rules dashboard for quick
11
insight into the rules that are firing in your environment.
12
13
14
15
Please perform the following steps.
16
17
Step 4.1: From the Exabeam Security Operations Platform landing page, select the
Dashboards tile. Alternatively, select the correlation rules icon from the
navigation menu:
Step 4.2: After the dashboards page loads, select the Correlation Rules dashboard
tile.
[Link] 1/7
4/6/24, 2:59 p.m. Mod4B_Ex2_Review the built-in correlation rules dashboard
Steps
10
11
12
13
14
15
16
17
Question 1
The built-in Correlation Rules dashboard supports
all of the following filters except which one?
Select one
Rule Severity
Alert Count
Trigger Count
Approx Log Time
Question 2
Which of the following visualizations is not
included in the correlation rules dashboard?
[Link] 2/7
4/6/24, 2:59 p.m. Mod4B_Ex2_Review the built-in correlation rules dashboard
Steps Select one
1
2 Most Rarely Triggered Rules
3
Rules by Use Case
4
5 Rule Severity Trend
6
Rules Triggered Over Time
7
10
11
12
13
14
Step 4.3: Expand the filter list and set the Approx Log Time to is in the last 1 days.
15
16
17
Step 4.4: Click Apply.
Step 4.5: In the Rules by Use Case visualization, click on any number in the table.
[Link] 3/7
4/6/24, 2:59 p.m. Mod4B_Ex2_Review the built-in correlation rules dashboard
Steps Step 4.6: A "DRILL INTO" message popup will appear. Select the Show All link.
1
10
11
12
13
14
15
16
Selecting a data point from a visualization and clicking Show All
17
allows you to view the triggers that make up the visualization.
Step 4.7: Close the Show All dialog box.
Step 4.8: In the Rules Triggered Over Time visualization, select the highest data
point in the graph for the "Password Spraying Attack" rule.
Step 4.9: Click the Show All link. A table of rule reasons appears, detailing the
names of the accounts used in the "attack" as well as the count of
triggers for the given timeframe.
[Link] 4/7
4/6/24, 2:59 p.m. Mod4B_Ex2_Review the built-in correlation rules dashboard
Steps
10
11
12
13
14
15
16 Step 4.10: Close the Show All dialog box.
17
Step 4.11: Scroll down to the Most Rarely Triggered Rules visualization.
Step 4.12: Select any number in the Count column. Note that the Count field
supports drilling down into the trigger details.
The Most Rarely Triggered Rules visualization only includes
rules that have triggered at least once in the given timeframe.
Step 4.13: Close the Show All dialog box.
[Link] 5/7
4/6/24, 2:59 p.m. Mod4B_Ex2_Review the built-in correlation rules dashboard
Steps Step 4.14: Scroll to the top of the dashboard and click the vertical ellipses menu.
1
10
11
12
13
14
15
16
Step 4.15: Select Download.
17
The dashboard download function allows you to save the results
as a PDF or CSV file. The PDF preserves the visual elements of
the dashboard, whereas the CSV format creates one CSV file for
each visualization, and each file contains the numeric details for
the rule triggers in that visualization.
Step 4.16: Close the Download dialog box.
[Link] 6/7
4/6/24, 2:59 p.m. Mod4B_Ex2_Review the built-in correlation rules dashboard
Steps Step 4.17: You have completed this section. Move on to the next section of the lab
unless otherwise instructed.
1
7
(OPTIONAL: Click the button below to print your
8
completed lab.)
9
10
11
12 Print Completed Lab
13
14
15
16 You have completed this exercise. Click the 'Next'
17 button in the bottom right corner to continue when
you are ready.
[Link] 7/7