Cortex Data Security Command Center

The Cortex Data Security Command Center is the central hub for understanding your organization's data security posture at a glance. It brings together data discovery, classification, posture, detection, and access governance into a single interactive view, helping you quickly see where your sensitive data lives, how it is protected, and what needs your attention next.

The layout is designed to guide you from the broad picture of your organization over the last 6 months—every data asset discovered across your environment—down to the specific issues, policy violations, and identities that pose the greatest risk, so you can determine the next steps to take for effective data governance.

The following image shows the Cortex Data Security Command Center:

How to access the Cortex Data Security Command Center

The Command Center is a system-provided dashboard and is typically your default view when you sign in.

To open it manually, select Dashboards & Reports → Dashboard, then choose Data Security Command Center from the dashboard drop-down menu in the header.

The Command Center is read-only and cannot be edited or deleted. To build your own version, select Save as new to create a custom dashboard you can modify while preserving the original. For more information, see Data Security dashboards.

The Command Center is interactive. Selecting a count, branch, or card redirects you to the corresponding inventory or issues view, filtered to the item you selected.

Data assets discovered

The header summarizes the total number of data assets discovered across your environment, along with the number of data store services covered.

Next to the total, a row of cards shows your onboarded providers with the number of accounts onboarded and the scanning Health for each provider. A healthy provider indicates that scanning is running as expected. Select a provider for more detailed information.

Data source distribution

On the left side of the Command Center, the data sources feeding the platform are broken out by type, each with the number of assets discovered.

Sensitive data assets

At the center of the Command Center is the total count of Sensitive Data Assets—the subset of your discovered assets that contain sensitive information. Beneath the total, the most common sensitivity categories are highlighted with their counts, such as PII, Sensitive, and Financial, with an indicator showing how many additional categories were detected. Select a category to drill into the corresponding assets in the inventory.

The center node also surfaces the number of AI Assets powered by sensitive data.

Module branches

Branching out from the sensitive data core, the Command Center connects each functional module to the sensitive data it protects, giving you a per-module summary of open work and progress.

Data Security Posture Management (DSPM)

Displays the number of Open Issues identified by posture assessment, broken down by severity level, alongside the number of Resolved Issues.

Select either category to review the corresponding issues.

Data Loss Prevention (DLP)

Displays centralized enforcement outcomes for sensitive Data-in-Motion across your enterprise.

The counts are split into:

• Prevented Policy Violations: Transfers that were actively blocked at the enforcement point based on your Data-in-Motion rules.
• Alerted Policy Violations: Transfers that were allowed to proceed but generated a security alert for review.

Select a policy violation category to review the underlying events, including the associated sensitive assets and the identities involved.

Data Detection and Response (DDR)

Displays the number of Open Issues raised by real-time threat detection (anomalous behavior or potential breaches), alongside the number of Resolved Issues.

Select either category to review the corresponding issues.

Identities and remediation summary

The footer of the Command Center ties access and remediation together across the whole environment:

• Human Identities: The number of human identities with access to sensitive data.
• Non-Human Identities: The number of service accounts, machine identities, and agents with access to sensitive data.
• Automated Issues: The number of issues handled through automated playbooks.
• Resolved Issues: The total number of issues resolved across the platform.

Select any of the above to view more detailed information.