CASE STUDY
Designing a security operations dashboard that turns alerts, threats, vulnerabilities, assets, and telemetry into a clear operational picture.
01
CONTEXT
An XDR environment brings together multiple layers of information: incoming alerts, monitored assets, active threats, vulnerabilities, telemetry volume, and geographic activity.
Each of these signals can be useful, but they do not carry the same urgency.
The dashboard needed to give the VSOC a broad picture of the environment while making it immediately clear where attention should go first.
The challenge was therefore not simply deciding what data to display, but determining how that data should be organized and prioritized.
02
THE CHALLENGE
Security analysts need to scan a large amount of information quickly.
If every metric receives the same visual weight, the analyst is forced to interpret the dashboard before they can use it.
The dashboard needed to answer several questions at different levels.
What requires attention now?
How many alerts are pending, and how severe are they?
What is happening across the environment?
Are alert volumes changing? Which threats and vulnerabilities are most active?
Is the monitored ecosystem healthy?
Are assets reporting correctly, and is telemetry continuing to arrive?
Where is the activity concentrated?
Which geographies, asset types, or data streams contribute most to the current picture?
The design challenge was to support all of these questions without turning the screen into a wall of equally weighted metrics.
03
RESEARCH
The research focused less on individual interactions and more on content selection and information hierarchy.
01
What information must be visible?
Which metrics and operational signals are essential enough to deserve space on the main XDR dashboard?
02
What should analysts see first?
Which information requires immediate attention, and which information can remain secondary?
03
How should signals with different levels of urgency coexist?
How can alerts, assets, threats, vulnerabilities, telemetry, and geographic activity be presented as one coherent operational picture without giving every signal the same visual weight?
01
I worked with two Product Managers to identify the information they considered essential for the dashboard and to clarify the product and operational context behind each metric.
02
I spoke with VSOC analysts about information hierarchy: what they need to understand first, what supports prioritization, and what can remain available as secondary context.
03
I reviewed several cybersecurity dashboards to examine how other products structure dense operational information, use visual hierarchy, and balance high-level status with deeper supporting metrics.
01
The dashboard could contain a large amount of information as long as the most urgent signals were visually distinguishable from supporting context.
02
Pending alerts and severity provide the clearest indication of what may require analyst attention now.
03
The dashboard needed to show both the current security workload and whether the monitored environment itself was reporting normally.
04
A raw count becomes more useful when analysts can also see change over time and identify the threats or vulnerabilities contributing most to the activity.
05
Telemetry volume and geographic distribution provide useful context, but they should not compete visually with active security signals.
RESEARCH DIRECTION
FROM
A collection of metrics
TO
Urgency → Security activity → Operational context
04
KEY PRODUCT DECISIONS
DECISION 01
PROBLEM
The dashboard contains many types of information, but only some indicate work that may require immediate analyst attention.
DECISION
Place Pending alerts at the top of the dashboard and organize them by severity:
Critical · High · Medium · Low
Support the totals with new-alert counts and directional change.
RATIONALE
The first layer should let the analyst understand the current workload without interpreting the entire dashboard.
DECISION 02
PROBLEM
A change in security activity is difficult to interpret without understanding whether the monitored environment and its data streams are operating normally.
DECISION
Place Monitored ecosystem alongside Pending alerts, showing the scale and reporting status of:
Vehicles · EVSEs · API endpoints · Consumers
along with overall data-stream health.
RATIONALE
The analyst can immediately distinguish between the security picture and the health of the environment generating that picture.
DECISION 03
PROBLEM
Alert totals alone do not explain what is driving the current security picture.
DECISION
Use the next dashboard layer to combine:
The trend provides temporal context, while ranked lists expose the security issues contributing most strongly to the current activity.
RATIONALE
The analyst can move from:
“How much activity is there?”
to:
“What is driving it?”
DECISION 04
PROBLEM
Telemetry processing and geographic activity are useful for understanding the broader environment, but they should not compete with the primary security workload.
DECISION
Place Data processing and Alerts by country lower in the hierarchy.
RATIONALE
The information remains available for situational awareness while preserving the priority of active security signals above it.
05
THE EXPERIENCE
01SCAN
The analyst begins with Pending alerts and Monitored ecosystem.
Together they answer two immediate questions:
How much security work requires attention?
and
Is the monitored environment operating normally?
02PRIORITIZE
The Daily alert volume trend reveals how activity is changing over time.
Ranked threats and API vulnerabilities identify the issues contributing most strongly to the current security picture.
This creates a natural progression from overall volume to specific areas that may require investigation.
03CONTEXTUALIZE
Data processing shows the volume and recency of incoming telemetry across the ecosystem.
Alerts by country adds geographic context and helps expose where alert activity is concentrated.
These signals support situational awareness without competing with the more urgent information above them.
The XDR Dashboard organizes a broad set of security and ecosystem signals according to how analysts need to consume them.
It begins with immediate workload, moves into the threats and vulnerabilities driving that workload, and then provides the operational context needed to understand the broader environment.
See what needs attention.
Understand what is driving it.
Keep the wider system in view.