Analytics turns your events into dashboards for each connected provider. Open it from the sidebar or press g then m. You need the metrics.read permission to open it and the logs.query permission to query events.
The landing page
The landing page shows Events, Providers and Datasets for the selected window, event volume by provider and by dataset, and Choose a dashboard. If you have the billing.read permission, it also shows Ingestion volume and cost for the current billing period. Costs marked Estimated are projections, not invoices.
Dashboards
The rail on the left lists Overview, then each connected provider with its dashboards, then Metric definitions. Providers you have not connected are listed under Not connected, with Connect.
| Provider | Dashboards |
|---|---|
| Cloudflare | Application security, Account audit |
| Microsoft Entra ID / Microsoft 365 | Sign-ins, Directory audit, Security alerts |
| CrowdStrike Falcon | Hosts & detections |
| Every connected provider | All events |
A dashboard shows Key figures, Attention needed, Outliers and Recent events. Filter by connection and time range. Open in Logs opens the same events in Logs.
If a dashboard's datasets are not enabled on any connection, it says so and offers Manage connection. Providers marked beta are not yet certified against a live tenant.
Outliers are computed in your browser from the aggregates on the page. They are labelled heuristics, not findings.
Metric definitions
Metric definitions lists versioned metrics computed over the full received stream before sampling. Choose a Metric, a Range from the last 24 hours to the last 13 months, a Resolution and, optionally, Break down by and Compare with previous period. Each metric is marked Exact definition or Approximate definition, and approximate or incomplete periods are labelled.