Security Insights Dashboard

The Security Overview tab of the Security Insights dashboard is the landing page for cross-domain security status. It summarizes what generated traffic, whether Secure Access allowed or blocked threats, and which enforcement controls acted on the traffic. Use the Security overview tab to understand overall security posture, traffic flow, threat outcomes, and enforcement activity across Secure Access.

Summary cards

Shows a quick health snapshot for the other dashboard tabs and lets you move to the tab that matches the question you have.

Security traffic flow

A diagram that maps traffic from Sources → Threat outcome → Security enforcement. Shows which users, locations, sites, or devices generated traffic, whether threats were allowed or blocked, and which controls enforced the traffic. Use the period switcher (24 hours, 7 days, 30 days, 60 days) at the top right.

Hover over a card to highlight the related flows. Click a card to open a detail drawer.

Below the diagram:

• Top Rules Allowing Threats — Click a rule name to open the rule in the Access Policy.

• 30-day trend line — Threats allowed versus blocked (fixed 30-day interval).

Security posture

• Enforcement summary — 30-day view of enforcement activity.

• Active threat feed — Blocked threats by severity and type over the last 24 hours, including malware, command-and-control, phishing, grayware, and cryptomining.

The Data Security tab of the Security Insights dashboard provides visibility into Data Loss Prevention (DLP) violations across channels and data classifications. Use this tab when you need to understand where sensitive data is moving, which rules are triggered, and who or what is responsible for violations. Use this tab with the Data Loss Prevention Report when you need the underlying events and filters.

Summary cards

See total Data Loss Prevention violations, enforced violations, and high-severity violations for the current period.

Click any card to open the Data Loss Prevention Report.

DLP violations by channel and classification

• Data Loss Prevention Violations by Channel — Breakdown or trend view across Web, SaaS API, Email, Endpoint, Private Apps, and Other.
• Data Loss Prevention Violations by Classification — PII, Financial, HIPAA, Intellectual Property, and Other.

Top Data Loss Prevention Violations by User

Users with the most policy violations over the last 30 days, including channel, violation count, and classification. Click View all violators to open the Data Loss Prevention Report.

Top DLP Rules Triggered and Apps Receiving Sensitive Data

• Top Data Loss Prevention Rules Triggered — By hit count over the last 30 days.
• Applications Accessing Sensitive Data — Destinations with DLP violations, with a breakdown or trend view.

Top Data Flows

Violation patterns across channels, data types, and exit points.

The AI Governance tab of the Security Insights dashboard provides visibility into Generative AI application usage, AI Guardrail violations, and sensitive data sent to GenAI destinations. Use this tab when you want to review generative AI adoption and decide whether you need an app-centric investigation, a rule review, or a data protection review. Use the App Discovery Report for app-centric investigation and the Data Loss Prevention Report for content- and rule-centric investigation.

Summary cards

Shows the number of discovered GenAI applications, AI guardrail violations, and blocked AI requests.

GenAI Application Map

A network diagram centered on GenAI apps, with nodes for the highest-volume and most-used sub-categories, plus developer tools, image generation, and data analysis. Each node shows apps, traffic volume, and identity counts. Includes a 30-day web traffic trend.

AI Guardrail Violations

Table of violations by type (Prompt Injection Attempt, Sensitive Data in Prompt, Jailbreak Attempt, Unauthorized Model Access, Ethical Violation), count, severity, and 30-day trend. Click a row to open the

Click View in DLP Events to open the Data Loss Prevention Report.

For more information, refer to Add an AI Guardrails Rule to the Data Loss Prevention Policy and Manage AI Guardrails Data Classifications.

DLP Violations for GenAI and Sensitive Data Sent to GenAI

• DLP Violations for GenAI — By data classification, last 30 days.

• Sensitive Data Sent to GenAI — By classification, detection type, and destination.

Click View in DLP Events to open the Data Loss Prevention Report.

The Applications tab of the Security Insights dashboard helps you understand application use and third-party application risk before you open detailed application reports. Use this tab when you want to review application adoption and decide where to allow, block, or investigate an application. Use this tab together with your Access Policy when you need to move from observed application use to policy changes.

Summary cards

Shows how many applications are allowed, not allowed, unreviewed, or identified as third-party risk.

Top Apps by Usage

App usage alongside DNS request counts. Click View in App Discovery to open the App Discovery Report.

Not Allowed Apps and Top Risky Apps

• Not Allowed Apps — Apps that users are attempting to access despite policy restrictions. Click View not allowed in Events to open the Events Report.

• Top Risky Apps — Discovered apps with a risk score greater than 7.0. Click View in App Discovery to open the App Discovery Report

High Risk Third-Party Apps and Top Users with Risky Third-Party Apps

• High Risk Third-Party Apps — Sourced from the Third-Party Apps Report.

• Top Users with Risky Third-Party Apps — Users with the most high-risk app permissions. For more information, refer to View User Details

Click View in Third-Party Apps to open the Third-Party Apps Report.

The Users tab of the Security Insights dashboard provides visibility into user trust levels, top risky users, User and Entity Behavior Analytics (UEBA) detections, and connection type distribution, scored by Cisco Identity Intelligence (CII). Use this tab when you want an identity-first investigation path that starts with trust, recent detections, or how users connect. Trust level and behavior data are most useful when you pair this tab with Manage Behaviour Analytics Configuration.

Summary cards

Shows how many users are high risk, how many active users are scored, and what percentage of users are at Neutral or above trust.

For more information, refer to View Users Provisioned in Secure Access and Integrate Cisco Identity Intelligence with Secure Access

User trust levels, Top 5 risky users and Recent UEBA detections

Distribution of users across trust levels, and a list of the highest-risk users in the environment.

Detections from User and Entity Behavior Analytics, including:

• Impossible Travel — Identify events from geographically distant locations within unrealistic timeframes.
• File Operations — Monitor file operation thresholds for downloads, uploads, and deletions within defined periods.
• DLP Violation Spike — Detect unusual increase in DLP policy violations within a specified time period.
• High-Risk Country File Activities — Monitor file uploads sent to and file downloads from countries you designate as high-risk.
• Anomalous MCP Activity — Detect unusual Model Context Protocol (MCP) activity, including potential injection activity or a sudden increase in requests.
• Unseen Location Activity — Monitor user activity from a city or source IP address that was not observed for that user during the previous 60 days.
• Traffic Spike and Destination Monitoring — Detect unusual increase in requests to a specific destination or any TOR relay.

For more information, refer to View Users Provisioned in Secure Access and Integrate Cisco Identity Intelligence with Secure Access.

Risky behaviour breakdown

Distribution of UEBA-scored risky behaviors. For more information, refer to Add and Edit Alert Rules for Behavior Analytics.

Connection types: VPN versus ZTNA

Distribution of VPN versus ZTNA sessions over the last 30 days, with a toggle between breakdown and trend views. Click View connection data to open the Events Report.

The Threat tab of the Security Insights dashboard helps you identify where Secure Access blocks threats, where policy allows threats, and which rules, destinations, categories, or users require follow-up. Use this page when you need to separate detection coverage from policy gaps and decide whether to tune policy, investigate users, or review destinations. Use this page with the Events Report when you need to inspect the underlying detections.

Summary cards

Shows how many threats were blocked, how many were detected overall, how many were allowed, and how many distinct sources generated the activity.

Click a card to open the Events Report.

Blocked and allowed threats and Top rules allowing threats

• Blocked and Allowed Threats — Shows which threat categories Secure Access blocked and which categories still reached users or destinations. By category: Command and Control, Malware, Grayware, Phishing, Cryptomining.
• Top Rules Allowing Threats — Shows which rules permit traffic that later matched threat detections. Policies permitting threat traffic; review recommended.

Threat trends

Shows whether blocked, allowed, and total threat volume is rising or falling over time.

Toggle between stacked threat volume and a line chart of blocked, allowed, and total threats (30 days). Click View in Events to open the Events Log.

Detection efficacy

• Top Rules Blocked — Rules generating the most blocks.
• Rules with 0 Hits — Rules that have never matched traffic; candidates for review or removal.

• Top Risky Destinations — Highest-risk destinations by threat volume.
• Threats by Category — Detected volume by threat type over the last 30 days.

Top blocked users

Users generating the most blocked threat traffic over the last 30 days. Click through to Manage Users, Groups, and Endpoint Devices.