Dashboard > Overview

Dashboard > Overview

Your detection performance at a glance. The dashboard summarizes your cyber detection capabilities across all attack simulations run by your organization.


Two controls apply throughout: the switch at the top right includes or excludes archived campaigns, and each section's slider toggles values between absolute numbers and percentages.
For the meaning of the statuses, severity, scores and Simplified Kill Chain used below, see  Scores & statuses .



Main KPIs

The top line shows the total number of campaigns (any status), the total number of simulations, the total number of executed events, the number of qualified events (those with a detection status other than Unqualified), and the number of Alerted events.

Campaign statistics

  • Cybersecurity score — the average score across all events in all campaigns, whatever their status; it measures how well your simulated attacks are detected. See the scoring method in  Scores & statuses .
  • Score evolution — the score trend for your campaigns; you choose which campaigns to include and the time frame.
  • Campaign targets — the types of information system targeted by your campaigns.

Detection efficiency

  • Status synthesis — distribution of events across the four detection statuses.
  • Mean Time to Detect (MTTD) — average time between an event's execution and the resulting alert. Computed for Alerted events only, and only when detection dates & times are provided.
  • Detection per severity — distribution of detected (Alerted) events by severity.
  • Sources for Alerted & Logged events — the tools and solutions that detected the simulated attacks. Useful to spot your most effective sources and those under-exploited (unused, or misconfigured — no access to the required data, incorrect settings, disabled features).

Reaction efficiency

  • Status synthesis — distribution across reaction statuses (Reacted, Ignored).
  • Mean Time to React (MTTR) — average time between the alert and the applied response. Computed for Alerted events that have both detection and reaction dates & times.
  • Reaction per severity — distribution of events with a reaction, by severity.
  • Reaction strategy — distribution of the response actions taken; an event can have several reactions.

Detection coverage — Simplified Kill Chain

Distribution of executed events across the three BlackNoise Simplified Kill Chain phases.

Detection coverage — MITRE ATT&CK

Distribution of executed events across the MITRE ATT&CK tactics. A tactic is the adversary's goal — the "why" behind a technique. You can hide or show empty tactics, and switch between a split or grouped view of events per tactic.