Let's look at each metric in the Service Review dashboard. To open this dashboard, select Dashboards > Service Review. Remember, in the upper left of this dashboard, you can select the time period you want to view.
How are we working together?
On the left, this area shows you the median time from alert arrival in Workbench to the first remediation action completed, for incidents that require verification with your organization. You can see how responsive your organization is when we send you an alert.
On the right, this area shows you the median time from alert arrival in Workbench to the first remediation action completed, for incidents that don't require verification with your organization. You can see how responsive Expel is after an alert happens that we can fix without notifying your organization first.
Under this area, 3 panels show more details.
In the area on the left in our example screen, you can see our actual triage times for alerts.
In the middle area, you see the median time it takes for your organization to verify after Expel assigns a verify action to your organization. In our example, it takes the organization a median of about 4.5 hours to respond. This can be an area the organization wants to improve over time because it reflects how quickly the organization responds to a security question.
In the right area, you see the median time it takes for your organization to complete a remediation action after Expel assigns a remediation action to your organization. In our example, it takes the organization about 2 minutes to remediate. This number varies with each organization and can help you track your internal progress. This can be an area the organization wants to improve over time.
How we think about verify actions
In the next area, click the text to see information about how your organization can improve these metrics.
Automations and context
This area shows you how your automations and context are performing over the specified time period.
Alert count by time of day
This area shows you a heat map of alerts for your organization over the times of the day and days of the week. This information can help your organization staff the times when alerts are more common. Of course, Expel is working 24/7.
What has Expel been up to?
The panel on the left shows you the detections that were added or updated for the specified time period.