Trend Insights
Trend Insights shows how risk and findings change across scans. You can limit the scans by policy and date range.
The selector at the top-right of the page chooses which provider the trends are drawn for. Providers present in the scans (Active Directory, Azure, AWS, GCP and GitHub) are listed under In this scan. The others are listed under Not in this scan and cannot be selected. Type to filter the list. The choice is kept until you close the browser tab.
The page title shows the number of scans the trends are drawn from, for example Trend Insights (5 Scans). The header offers the following controls:
Policies: Selects the scan policies whose scans are included. At least one policy is required. When none is selected, a Required warning is shown.
Date range: A date picker and a list of preset ranges (Last Week, Last Month, Last 2 Months, Last 3 Months, Last Year) limit the scans to a period. Picking dates by hand shows Custom.
Print: The print button prints the visible sections.
The gear next to the page title opens the list of sections, where you can show or hide each one. The sections are Risk Score Stats, Risk Breakdown by MITRE ATT&CK, Risk Score, Exposure Score, Dangerous Path Count, Vulnerabilities by Severity, Affected Entity and Total Affected Entity Count, Shadow Admin and Risky Admin User Count, Asset Stats, Risky Asset Stats, Risk Score By Top 5 Tags, Risk Score By Top 5 Impacts and Credential Discovery Secret Count. Asset Stats, Risky Asset Stats and Credential Discovery Secret Count are shown for Active Directory only.
The charts are drawn for the selected provider. The sliders below and to the left of each chart zoom into a range of scans or values. Right-clicking a scan's data point offers Hide, which removes that scan from the chart. The Reset Data button restores it, and the save button downloads the chart as an image.
Risk Score Stats
The band at the top of the page compares the newest scan in the range with the oldest one. Each card shows the value for the newest scan and a badge with the change since the oldest scan: Risk Score, Exposure Score, Tier 0 Identities, Dangerous Path, Shadow Admins and the number of Critical, High, Medium, Low and Info issues.
Risk Breakdown by MITRE ATT&CK® Tactics
The gauges show the risk grade of each MITRE ATT&CK tactic. When the grade has changed within the range, the gauge shows both grades with an arrow icon between them, from the oldest scan to the newest, for example F to A.
Risk Score
The Risk Score graph shows the overall risk level of the selected provider's environment in each scan.
Exposure Score
The Exposure Score graph shows the level of exposure in the selected provider's environment in each scan.
Dangerous Path Count
The Dangerous Path Count graph shows the number of risky access paths in the selected provider's environment that an attacker could use to reach sensitive assets.
Vulnerabilities by Severity
The Vulnerabilities by Severity graph shows the number of vulnerabilities at each severity level (Critical, High, Medium, Low, and Informational) over time.
Critical: The number of Issues with Critical severity.
High: The number of Issues with High severity.
Medium: The number of Issues with Medium severity.
Low: The number of Issues with Low severity.
Info: The number of Issues with Info severity.
Affected Entity and Total Affected Entity Count
The Affected Entity and Total Affected Entity Count graph shows the number of affected entities at each severity level (Critical, High, Medium, Low, and Informational) in each scan. Use it to follow the effect of remediation.
Statistic
Description
Critical Affected
The number of entities affected at a critical level.
High Affected
The number of entities affected at a high risk level.
Medium Affected
The number of entities affected at a medium risk level.
Low Affected
The number of entities affected at a low risk level.
Info Affected
The number of entities affected by informational level issues.
Total Affected
The total number of affected entities across all risk levels.
Shadow Admin and Risky Admin User Count
The Shadow Admin and Risky Admin User Count graph shows the number of risky admin accounts (Risky Admin) and shadow admin users (Shadow Users) over time.
Asset Stats
The Asset Stats graph shows the number of Admin, Privileged, Local Admin and Shadow objects in the Active Directory environment over time.
Statistic
Description
Admin Object
The number of administrative objects, such as accounts with admin privileges.
Privileged Object
The number of objects with elevated permissions.
Local Admin Object
The number of objects with local administrative rights.
Shadow Object
The number of shadow admin objects: objects that can compromise an admin object through an attack path.
Risky Asset Stats
The Risky Asset Stats chart shows the count and percentage change of Risky Admin Object, Risky Privileged Object, Risky Local Admin Object and Risky Object across scans.
Statistic
Description
Risky Admin Object
The number of high-risk admin objects.
Risky Privileged Object
The number of high-risk privileged objects.
Risky Local Admin Object
The number of high-risk local admin objects.
Risky Object
The total number of high-risk objects.
Risk Score By Top 5 Tags
The Risk Score By Top 5 Tags graph shows changes in risk levels for the five tags with the highest risk in the newest scan in the range. The tags depend on the findings, so they differ between environments.
The tags in the example above are:
Tag
Description
Privilege Management
The risk score related to managing access permissions and controls.
ACL
The risk score related to Access Control Lists.
Anomaly
The risk score related to unusual or unexpected activities.
Password Security
The risk score related to password policies and password handling.
Privileged Account Security
The risk score related to the security of privileged accounts.
Risk Score By Top 5 Impacts
The Risk Score By Top 5 Impacts graph tracks risk trends for the five impacts with the highest risk in the newest scan in the range. The impacts depend on the findings, so they differ between environments.
The impacts in the example above are:
Impact Type
Description
ACL Based Attack Path Exploitation
The risk score for exploitations through access control lists (ACLs).
PrivExchange
The risk score related to the Exchange and NTLM relay attack vector.
Unconstrained Delegation Exploitation
The risk score related to exploiting unconstrained delegation.
Persistence with Access Control Entries
The risk from persistence through access control entries.
Credential Theft Attacks
The risk score related to credential theft.
Credential Discovery Secret Count
The Credential Discovery Secret Count graph shows the number of secrets that Credential Discovery found in file shares in the Active Directory environment.
Last updated
Was this helpful?