Using the dashboard
When you open On Demand Audit, the dashboard displays a visual summary of the most important metrics of the Office 365 and Azure Active Directory activity in your organization.
You can use the data to discover trends and quickly locate the information that you need. To further drill into the event details, you can use the visualizations offered with searches. See Visualizing searches.
The information in the dashboard is updated in real time, allowing you to quickly gain valuable insights into the activity taking place in your organization.
The Overview tab displays:
- Number of events (Event count)
- Total number of unique users
- Activity (A drop-down is available so that you can select the activity that you want to see.)
- User Name (A drop-down is available so that you can select the users that you want to see.)
- Top 10 active users
- Activity heat map that visually breaks down the activity in a display that shows which events are more prevalent.
The Sign-ins tab displays:
- Sign-ins by location on a map
- Sign-ins by unique application and users or you can filter for specific applications and users
- Successful and failed sign-ins
- Sign in activity timeline
By hovering over the right corner of any section, you are provided with more options for sharing and customizing the data.
- Select Export data to .xlsx or .csv file.
- Sort the data
- Use the available slider to fine grain the dates included in the view.
You can also perform a broad search through all your events, using the Quick Search.
Searching for specific event data (Quick Search)
Performing a quick search allows you to search through all events based on a specific value, term, or keyword.
To search for data within an event
- Enter the search term in the Quick Search box and click the magnifying glass icon.
The resulting lists display all events that have a value matching the search term or value, sorted by the time detected. The search terms are highlighted in the search results and event details to allows you to quickly scan for matches.
|
|
NOTE: You can also export the search results to a .csv or zip file by selecting the Export button. The location for the file is determined by your browser settings. |
Working with searches
- Running a search
- Using built in searches
- Creating a custom search
- Copying an existing search
- Exporting a search
- Creating a search from an existing search
- Creating or filtering a search based on event details
- Appendix A: Working with search columns and filters
- Customizing the columns displayed in a search
- Visualizing searches
- Viewing search results and event details
- Copying event details
- Modifying a search
- Deleting a search
- Working with categories
Running a search
Once On Demand Audit captures an event, you can view all available event data through searches. You can use custom searches based on your own criteria or built in searches that are configured to meet the most common requests. See Creating a custom search and Using built in searches.
|
|
NOTE: Custom user-built searches are identified by the following icon to the left of the search.
|
To run a previously saved or built in search
- Select the Searches tab.
- Locate the required search in the list of categories.
- To run the search, simply click it or highlight it and click the run (arrow) icon.
- Select an event to see all the event details.
- Modify the search (Custom user-built searches only). See Modifying a search.
- Refresh the display.
- Visualize the event data. See Visualizing searches
- Select a column to sort the search results by column.
- Create a new search or filter the search based on a specific event detail. See Creating or filtering a search based on event details.
- Create and disable alerts. See Working with alerts and alert plans.