The TAAM dashboard provides a visualization of how your organization's security controls perform against various Threat Actors. All panels share some common features:
Each panel is populated based on the results of Actions that have run.
NOTE: The TAAM dashboard does not include Port Scan Actions.
- The default time frame for all panels is the Last two weeks, using the time zone you configured in User Preferences (accessed by clicking User > User Preferences).
- The panels are interactive. You can click on the bar chart, points in the chart, and some labels to bring up the Jobs associated with the data. All Jobs, not Jobs for the specific segments of the bar charts, are included.
To view the TAAM dashboard, go to Analyze > TAAM Dashboard.
TAAM Dashboard
Panel Details
The default dashboard includes five panels:
- Readiness: Malware Families
- MITRE ATT&CK: Tactic Radar
- Control: Prevented, Detected, Missed, & Total Tests
- Readiness: Threat Actors
- Trending: Block Rate
The following sections provide information on the panel defaults and options.
This section describes the out-of-the-box default settings for the TAAM dashboard. If you are seeing something different, an Admin or Power User has updated the defaults, configuring the dashboard to meet your organization's interests.
Readiness: Malware Families
This panel displays your controls' effectiveness for five Malware Families. Data for this panel is based on Job results for Actions that have malware family tags (Malware: Family Name) and shows which security technologies were associated with the Jobs. If your Threat Intelligence Integration includes malware family information, such as Intel471, you can change the panel to display that instead.
To allow you to better understand the effectiveness of your controls, there are separate bar charts for Network Behaviors and Host Behaviors. The bar charts have segments for Actions that were detected, prevented, fired an alert, or were missed. The default sort option shows families with the most recently-created Actions listed first, but there are four other sort options.
Readiness: Malware Families panel
MITRE ATT&CK: Tactic Radar
This panel allows you to quickly see how your security controls are doing in relation to the MITRE ATT&CK Tactics. If the block rate is above 75%, the information displayed is green. If below, it's red. You can change the threshold to reflect your organization's priorities. The chart includes points for each Tactic; hovering over the Tactic shows the totals for that Tactic. You can click on the point or the label to jump to the list of Jobs that the data is based on.
If you are interested in seeing where the focus of your testing has been, change the Display Data to Total Actions Run. Since this chart doesn't use a threshold, the chart will now be yellow. This view allows you to quickly see which Tactics have the most and least amount of testing.
MITRE ATT&CK: Tactic Radar Panel
Control: Prevented, Detected, Missed, & Total Tests
This panel displays a series of bar charts showing the total number of tests run over the past three months. Each bar has segments to show the number of Actions that were prevented, detected, alerted on, and missed. Data for this panel is based on Job results for Actions. The Actions either have ATT&CK tags or are part of Sequences and Evaluations that have Threat Actor aliases as tags.
Control Prevented, Detected, Missed, & Total Tests Panel
Readiness: Threat Actors
By default, this panel displays how well you are protected against five Threat Actors, based on MITRE ATT&CK Techniques. The Threat Actors are those that are marked as Important, which you've either done in the Threat Actor Library or were imported from your Anomali Threat Intelligence Integration. For a more general view, you can change this to list the Actors alphabetically.
Data for this panel is based on Job results for Actions. The Actions must include the MITRE ATT&CK Technique tag that matches information listed in the Threat Actor's Tactics, Techniques, & Procedures section. The Threat Actors with the most recently-run security content is listed first. If you'd prefer a different sort order, there are four others to choose from. Click on the Threat Actor name or flag to view or edit its profile.
NOTE: If you are seeing the unknown flag 
, you have not set the country of origin in the Threat Profile.
Readiness: Threat Actors Panel
Trending: Block Rate
This panel allows you to quickly see how well your security controls block Actions over a given time frame. If the block rate is above the threshold, which is 75% by default, the line and time frame are green. If the block rate is below, they are red. Data for this panel is based on Job results for Actions. The Actions either have ATT&CK tags or are part of Sequences and Evaluations that have Threat Actor aliases as tags.
At regular intervals during the time frame, there is a point that provides the counts for that interval. You can click on these to jump to the list of Jobs that make up the data point.
Trending: Block Rate panel