[Music] thank you [Music] hey everyone it's Justin thank you for watching and welcome to my house that's Justin's house in this video I want to talk to you about the May 2023 updates to security incident response workspace I got the store application up here behind me if we click we're on version 1.1.0 this just came out in Utah and now they've already updated it in the May 2023 update we see here support for crowdstrike Falcon host integration and what I'm going to show you in this video CSO and manager overview dashboards now I had to go look at my old video to see what dashboards were there before I know this is going to be blurry on the video but essentially when this came out version one we had contact sensitive analytics security analyst overview security incident Explorer Incident Management and Incident Management Premium kpis Plus security operations efficiency so let's take a look at what the changes look like this is one of my demo showcases and I'm just gonna hop in I'm actually already in security incident response workspace and I'm going to hop over to the sir dashboards here's a security analyst overview and this is the new dashboard menu so there's that content context sensitive analytics where we had before but now I've got a CSO dashboard or chief information security officer dashboard this is what it looks like not all of my performance indicators or kpis are going to show I expect that in my demo instance especially as something so new like this but now we can see average time to identify weekly average time to contain average time to eradicate all weekly here we've got new security incidents this week that is a lot security incident close this week that is a lot new security incidents running seven days in security incidents closed running seven days that one was kind of behind my head so let's scroll up a little bit so you can see uh what's down below I've got new closed security incidents daily graph new closed Securities weeklies it's security incident closed codes and then one that's loading up there I'm probably not going to actually have data for that one either but to get the idea new CSO dashboard let's check out the CSO reporting overview also new but not as pretty when I looked at this earlier after seeing making sure all these were working in my workspace there we go I've got new security incidents this week closed this week uh new security incidents running seven days security until closed seven days uh average time to identify contain average time they contain critical ones if you look down before in my instance where it's not available weekly new security incidents weekly closed security incidents and security incident closed codes these are probably just scheduled jobs that haven't had time to run yet where they need to go activate and get them running so not surprised to see that but let's take a look at the last new one which is going to be the security incident manager overview that's the other new one all the rest of those there were there in version one so let's take a look at security incident manager overview and as you can see it looks a little bit like the same as we were looking at with the CSO but more focused on a team so we've got team critical team High SLA is expiring average time to contain critical average time to contain an average time to identify let's go up a little bit we got security incidents by CI class so we can see a mass storage device and a web server and a trend of all security incidents by category which is not showing on mine and let's see if this window shows it doesn't show down here trend of all security incidents by priorities so again probably a scheduled job I need to go change or Go activate or go run in this particular instance but you can see uh with this new version they've added three new dashboards for you to look at again these are built on performance analytics workspace and then added to these workspaces CSO dashboard CSO reporting overview and security incident manager overview hey guys I was in the middle of recording or editing that video that you're watching and I just had to fix the the widgets on these dashboards I was like I can't post this and have all these errors so I went and ran all the jobs that were associated and I edited some filters so you can see all the widgets are working now um the the job there's some historical jobs that you need to run especially if you've got a lot of data in your system and as far as the date filters like you can see here there was weekly new security incidents and closed that wasn't showing and that's because in my demo showcase we generate data like at a certain period of time and then we let it sit there and show it we're not continually generating data like you see in a production environment so I had to adjust some things so that filters would let all that stuff through so that was the second dashboard you just saw there and then here's all the fixes on a security manager overview dashboard so there's all the widgets working and I'll return you to your regular schedule program I hope you found this video helpful if you did please like Please Subscribe or share with somebody who you think might be interested in having different lenses and different dashboards within their secure incident response workspace and until next time don't forget to always be learning [Music]