Cortex DDR Dashboard

The Cortex Data Detection and Response (DDR) Dashboard is the central hub for monitoring and responding to real-time threats against your data. It brings your data threats into a single interactive view. The dashboard covers real-time threat detections across Cloud, SaaS, and AI infrastructure.

The dashboard is designed to guide you from the current state of your environment—how many threats are open, how old they are, and how fast you are closing them—down to the individual issue you need to investigate.

A global time filter of 24H, 7D, or 30D applies to every widget on the dashboard, and defaults to 24H.

The following image shows the Cortex DDR Dashboard:

How to access the Cortex DDR Dashboard

You can open the DDR Dashboard from any of the following locations:

• Modules → Data Security → Data Detection and Response

• Dashboards & Reports → Dashboard, then choose Data Detection & Response from the dashboard drop-down menu in the header.

Current state

These widgets summarize your threat backlog and how quickly your team is working through it:

• Issue breakdown: The total open issues in your environment, broken down by severity.

• Mean time to remediate issues: The MTTR for critical, high, and overall issues, plotted per severity alongside the overall average.

• Open issues by age: Unresolved issues sorted by how long they have been in the system.

• Issue Burndown: A trendline of issues created against issues resolved, with the total for each shown in the legend. When more issues are created than resolved, your security debt is growing.

MITRE ATT&CK

Maps all open issues in the selected time filter to the MITRE ATT&CK framework, with the number of issues and techniques recorded against each tactic. You can track an attacker's progress and judge whether a quiet tactic reflects effective controls or a detection gap.

Note: The sum of the issues across all tactics may be greater than the totals in the widgets above, as a single issue can be recorded against multiple tactics.

Select a tactic or technique, or select Open full view to see the complete matrix.

Data security issues

Lists the individual threats in your environment so you can triage them by priority. Alongside the issue name, severity, and status, each row shows the insert time and the issue category. You can add further columns, such as the issue description and a link to the associated case.

Select a row to open the issue investigation view in a side card.