Activeboard: SentinelOne Activity Overview

[ 1 Purpose ] [ 2 Prerequisites ] [ 3 Open Activeboard ] [ 4 Use Activeboard ]

Purpose

This Activeboard checks the overall status of user agents, including recent operations such as new installations or updates. It allows you to detect abnormal behaviors including agent modifications, failed login events, or deletions. All data is provided in a summarized way, which allows security and system administrators to get a quick yet effective understanding of the installation.

Total Activities	Users Deleted	Activity Summary
User Logins	User Modified	Activity Types
Failed Logins	User Disabled Agent	Most Active Users
Users Added

Included in Content Pack

This Activeboard is part of SentinelOne Content Pack that contains five different SentinelOne Activeboards.

Prerequisites

To run this Activeboard, you must have the following data source available in your domain:

edr.sentinelone.agent.agents ^{learn more}

Open Activeboard

Once you have installed the Activeboard, you can use the Open button at the top right of the card in Exchange to access it and see the different widgets populated with the relevant data. You can also access the Activeboard area via the Navigation pane.

Data loading takes too long?

Sometimes some widgets take time to upload the data, it is possible to speed up the process by creating aggregation tasks. Refer to the Aggregation tasks article to learn how to do it.

Use Activeboard

After installing and opening the Activeboard, you can use its widgets to visualize and monitor data. To do this, each widget offers a variety of customization and visualization options. Refer to Using widgets and Using inputs to know them all.