Hey everyone! I've been diving into Exabeam for the past few months at my new job, and I'm really trying to wrap my head around all it can do. We're a pretty small team, and I come from more of a project management background, so I'm learning a ton about SIEM stuff as I go.
One thing our security lead asked me to look into is building a better way to track failed login attempts. I know Exabeam has all these analytics and timelines, but I feel like I might be missing a more streamlined view. The default dashboards seem really powerful, but also super broad? I'm looking for something more focused that we could maybe have on a monitor in the office.
So my main question is: does anyone have a good, specific dashboard setup for monitoring failed logins that they'd be willing to share or describe? I'm curious about a few things:
How do you break it down—by user, by source IP, by time of day? Are you combining it with other risk indicators, like if a failed login comes from a geographic location the user has never been in? What are the key widgets or charts you found most useful?
Also, I'm really interested in how this compares to what you might build in a dedicated no-code dashboard tool. Since my expertise is more in workflow automation, I keep wondering if I should be pulling Exabeam data into something else to make it more visual for the team, or if that's overcomplicating it and I should just master the native tools.
Any examples, screenshots (if allowed), or just a walkthrough of your logic would be incredibly helpful. I'm trying to build something that's not just useful for the security folks but also tells a clear story for the rest of the management team who might not live in the tool every day. Thanks in advance for any pointers you can offer!