> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/email-command-center.md). # Email Command Center {% hint style="info" %} ### Notice Requires the Cortex Advanced Email Security module. {% endhint %} The **Email Command Center** provides an interactive overview of your email security status that offers comprehensive visibility and control over email security threats and responses in your organization. With real-time insights and actionable intelligence, you can stay ahead of threats and make informed decisions with ease and confidence. In the face of sophisticated AI-driven phishing attacks and other social engineering tactics, the Email Command Center is essential for ensuring organizational security. It moves beyond isolated email analysis to offer a holistic view of potential attack chains, enabling proactive protection and rapid response. With drill-down capabilities, reveal detailed metrics and insights for deeper analysis and proactive threat management. Access the Email Command Center in **Modules** → **Email Security**. {% hint style="info" %} Select a time frame for a visualization of the different components that make up the current risk status of your domains. You can select between Last 24 hours, 7 days, or 30 days. The default time frame is 30 days. {% endhint %} The Email Command Center is made up of the following components: *** ### Cortex Advanced Email Security flow diagram View general information about the email security status of your organization in an intuitive, interactive flow diagram. You can drill down to the details to get a comprehensive understanding of the email security status of your organization. The diagram is made up of the following sections: #### Metrics about incoming data. * Identities * General email metrics: Numbers of scanned emails, domains, mail boxes, detected attachments and links. * Click **Attachments** to display the **Files Breakdown** table on the right. * Click **Links** to display the **URL Reputation** table on the right. * Endpoints: Information coming from Cortex XDR Agents. * Network data {% hint style="info" %} ### Note Adding more data into the Email Security module will ensure better detection of complicated email threat vectors. {% endhint %} #### Metrics about the issues and cases generated by the module. The module groups related issues into a single case to give context. Click anywhere in this area to open the **Trends and Metrics** widgets on the right. Under this section is a carousel that summarizes the remediation actions that were taken. #### Metrics about the automated and manual remediation actions that were taken, including a breakdown of resolved and open cases. Click **Resolved Cases** or **Open Cases** to see a breakdown of cases that were generated manually and by automation. *** ### Trends and Metrics The tables and widgets displayed on the right about the general insights. To return back to the general insights, click **Back to Overview**. #### Trending Attack Vectors: Details the type of identified attacks in the issues, with a description and the number of issues associated with each attack type. The percentage represents the change from the previous time frame, where red is an increase in attacks and green is a decrease. For example, if the attack count for the last 30 days is 6, and the percentage is 50%, in the previous 30 day time frame, there were 4 attacks, and in the current 30 day time frame there were 2 additional attacks. Click a row to display the Issues table filtered by the specific attack type. #### Mailboxes: Surfaces statistics about the coverage of the emails boxes and email directionality. **Mailboxes Coverage** shows the numbers for the following mailboxes: User, Shared, Room, Uncovered, Other. Under **Email Directionality**, you can see how many total emails were scanned, how many were inbound or outbound, and how many were internal. #### URL Reputation: Groups the links according to category, and provides the number of identified links in the current time frame and the number of links in the previous time frame. Each category is made up of a number of different types of link, grouped together under a descriptive title. The numbers inside the parentheses represent the number of malicious links. Click a row that references a malicious link to see the issues that are generated from the emails that contain the links in the category. #### Files Breakdown: Categorizes the detected files according to file family type, and provides the number of attached files in the current time frame and the number of attached files in the previous time frame. Each family type is made up of a number of different file types, grouped together under a descriptive title. The numbers inside the parentheses represent the number of malicious files. Click a row to see the issues that are generated from the emails that contain the file types in the file family. #### Top Cases by Smartscore: Presents the top ten cases listed in order of descending smartscore, with a description and the number of impacted endpoints and users. The smartscore is displayed in a box with colors that represent the severity. Click a row to see the case in detail. #### Remediation: Displays the remediation actions taken by the Email Security engine. Each row details the number of remediated emails, the number of remediation actions taken, and the detected errors. From each row, you can pivot to the **Remediation Action Center**. When there's no rule in the policy that triggers a remediation action, the action is marked as **Not Active** in this table. Click **Configure** to define a rule that triggers this action. {% hint style="info" %} ### Note The number of remediated emails and the number of remediation actions may not always be equal. This is due to a number of reasons, including different policies that affect the email messages or manual actions taken. {% endhint %} *** ### Dynamic insight widgets The widgets displayed on the bottom right of the Trends and Metric widgets provide information and enable drilldown to different parts of the system. #### Issues Over Time: Graph displaying the number of issues at each given point in the selected time frame. Click each section in the chart to view the **Issues** table filtered according to the selected time frame of the section. #### Risky Users: The number of users that were detected as being risky. The percentage represents the increase or decrease compared to the previous time frame. This widget also displays the top five risky users in descending order of risk score, together with their title in the organization, and the number of risky emails per user. If you have the ITDR module, the normalized risk score is displayed, and the email numbers and the risk score will be color coded to represent the severity of the risk. Click a user to open the **User** view. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/email-command-center.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.