Dashboard overview:

The dashboard is organized into several key areas:

[Your administrator should add a labeled screenshot of the dashboard here to help users orient themselves.]

Navigating the dashboard:

The main navigation menu runs along the left side of the screen and provides access to all modules:

Customizing your dashboard view:

1. Use the date range selector at the top of the dashboard to adjust the time period displayed
2. Click on any metric or chart element to drill down into the underlying event data
3. Use the environment selector (if available) to filter the dashboard to a specific monitored environment
4. Click Refresh to manually update the dashboard with the latest data

Understanding the activity trend graph:

The activity trend graph displays event volume over the selected time period. Use it to:

• Identify spikes in activity that may indicate a security incident
• Spot drops in activity that may indicate a collection or connectivity issue
• Establish a baseline of normal activity in your environment over time

If you notice an unexpected spike or flatline, navigate to View to investigate the underlying events in more detail.

Switching between monitored environments:

If your deployment monitors multiple environments (e.g., Windows, eDirectory, Azure), you can switch between environment-specific dashboards:

1. Navigate to the relevant environment from the dashboard or View menu
2. The dashboard will update to reflect activity for the selected environment only

Best practices:

• Check the dashboard at the start of each shift or workday as a quick health check
• Investigate any alert notifications visible on the dashboard before moving on to other tasks
• Use the activity trend graph to establish a sense of normal traffic patterns — this makes anomalies easier to spot over time
• If the Last Refresh timestamp is significantly behind the current time, check that all services and agents are running correctly

Accessing the View module:

1. In the main navigation menu, click View
2. Select a saved view from the list, or create a new one
3. The log table displays audit records matching your current filters and date range

Creating a new view:

If no saved views exist yet, or you need a view tailored to a specific purpose:

1. Click Create View
2. Configure the view settings:
   • View Name — a descriptive name for the view
   • Description — the purpose of this view
   • Environment — the monitored environment to display logs from
   • Category — the log category to focus on
   • Default Date Range — the initial date range shown when the view is opened
3. Navigate to the Columns tab and select which fields to display:
   • Drag columns to reorder them
   • Set column widths for optimal display
   • Enable sorting and filtering per column
4. Click Save

Filtering events:

Quick filters:

1. Use the filter bar at the top of the view
2. Enter search terms in the quick search box
3. Select filter criteria from the available dropdown menus
4. Results update in real time as you type

Advanced filters:

1. Click Advanced Filters
2. Add one or more filter conditions:
   • Select a field from the log schema (e.g., User, Event Type, Severity)
   • Choose an operator (e.g., Equals, Contains, Starts With, Greater Than, Is Null)
   • Enter a comparison value
3. Combine conditions using AND/OR logic:
   • AND — all conditions must match
   • OR — any condition must match
   • Nest condition groups for complex logic (e.g., (A OR B) AND (C OR D))
4. Click Apply Filters

Date range filter:

1. Use the date range picker at the top of the view
2. Choose from:
   • Quick ranges — Today, Yesterday, Last 7 Days, Last 30 Days, etc.
   • Custom range — specific start and end dates
   • Relative range — dynamic ranges that update automatically (e.g., Previous Month)
3. The log table refreshes automatically when the date range is changed

Searching log data:

Perform full-text searches across all collected log data:

1. Enter search terms in the search box
2. Choose the search scope:
   • All Fields — searches across every field in the log schema
   • Specific Field — searches within a single selected field
3. Use search operators for more precise results:

4. Press Enter or click Search

Sorting and navigating results:

• Click any column header to sort by that field
• Click again to reverse the sort direction
• Hold Shift and click multiple column headers for multi-level sorting
• Use the page size selector to control how many records display per page (20, 50, 100, or 200)
• Use Previous and Next to navigate between pages

Viewing full event details:

1. Click on any log row in the table
2. A detail panel opens showing:
   • All Fields — complete field values for the event
   • Raw Log — the original unprocessed log entry
   • Metadata — timestamp, source, and receiver information
   • Related Logs — links to related audit events
3. Click Close to return to the table view

Exporting log data:

1. Apply your desired filters and date range
2. Click the Export button
3. Choose an export format:
   • CSV — for use in Excel or data analysis tools
   • Excel — native Excel format with formatting applied
   • PDF — formatted document suitable for printing or sharing
4. Configure export options:
   • All Columns or Visible Columns Only
   • Include or exclude column headers
   • Set a maximum record limit if needed
5. Click Download

For very large exports, the system may queue the export and deliver it via email when complete. For datasets that regularly require large exports, consider scheduling a report instead.

Saving and sharing views:

• Click Save at any time to save your current filter and column configuration as a named view
• Click Duplicate View to create a copy of an existing view as a starting point for a new one
• Click Share to share a view with other users or roles, with either View Only or Edit permissions
• Click the Star icon on any view to add it to your favorites for quick access

Auto-refreshing views:

For real-time monitoring, enable auto-refresh to keep the view updated automatically:

1. Click the Auto-Refresh control
2. Select a refresh interval: 5s, 10s, 30s, or 1 minute
3. The view will reload at the selected interval

Use auto-refresh cautiously with large datasets or broad date ranges, as frequent reloads can impact performance.

Best practices:

• Set a reasonable default date range on saved views to avoid loading excessive data on open
• Display only the columns you need for faster load times
• Use named, saved views for recurring investigation tasks rather than rebuilding filters each time
• For large-scale data analysis, schedule a report rather than exporting directly from a view
• Use descriptive view names so other team members can understand the purpose at a glance

[Your administrator should create and share a set of standard views for common investigation scenarios so the team has a consistent starting point.]

Accessing the Reports module:

1. In the main navigation menu, click Report
2. You will see the following tabs:
   • All Reports — every report you have access to
   • My Reports — reports you created
   • System Reports — pre-configured reports included with LT Auditor ^MP
   • Shared Reports — reports created and shared by other users

Creating a new report:

1. Click Create Report
2. Configure the basic report information:
   • Report Name — a clear, descriptive name
   • Description — a summary of the report’s purpose and content
   • Environment — the monitored environment to report on
   • Category — the log category to include
   • Report Type — Standard, Summary, or Detailed
3. Navigate to the Columns tab and select which fields to include:
   • Drag columns to reorder them
   • Set column widths
   • Configure sorting (ascending or descending)
4. Navigate to the Operations tab and select which event types to include using the checkbox tree
5. Configure the date range filter:
   • Fixed Range — specific start and end dates
   • Relative Range — Last 7 Days, Last 30 Days, Last 90 Days, etc.
   • Custom Range — dynamic ranges such as Previous Month or Current Quarter
6. Optionally configure grouping and aggregation under the Grouping tab:
   • Select fields to group by (e.g., User, Date, Operation)
   • Configure aggregations such as Count, Sum, Average, Min, or Max
   • Choose a display format — table, chart, or both
7. Click Save

Running a report on demand:

1. Open the report from the reports list
2. Select the date range for this run if not already set
3. Click Generate Report
4. Wait for generation to complete — a progress indicator will display for larger reports
5. Download the report in your preferred format:
   • CSV — for use in Excel or data analysis tools
   • Excel — native Excel format with formatting applied
   • PDF — formatted document suitable for auditor submission or printing

Viewing report history:

Every time a report is generated, the result is saved so you can retrieve it later without regenerating.

1. Open the report
2. Click View History
3. Browse past report runs, each showing:
   • Generation date and time
   • Date range covered
   • Number of records included
   • Whether it was generated manually or by a scheduled job
4. Click any historical entry to download that report file

Scheduling reports for automatic delivery:

1. Open the report configuration
2. Navigate to the Schedule tab
3. Click Add Schedule
4. Configure the schedule:
   • Frequency — Daily, Weekly, Monthly, Quarterly, or Yearly
   • Day and Time — when the report should generate
   • Time Zone — the timezone for schedule execution
   • Date Range — what time period each scheduled run should cover
5. Configure delivery options:
   • Email Recipients — the addresses to send the report to
   • Format — CSV, Excel, or PDF
   • Subject Line — the email subject template
   • Message — optional body text for the delivery email
6. Click Save

Avoid scheduling many reports to run at exactly the same time. Staggering report schedules helps maintain system performance.

Sharing reports:

1. Open the report
2. Click Share
3. Choose who to share with:
   • Specific Users — select individual users from the list
   • Roles — share with all users assigned to a specific role
   • Public — available to all users (if permitted by your administrator)
4. Set the permission level:
   • View Only — users can view and generate the report but cannot modify it
   • Edit — users can modify the report configuration
5. Click Save

Using report templates:

Templates save a report configuration so it can be reused as the starting point for new reports.

Saving a report as a template:

1. Configure a report with the desired filters, columns, and settings
2. Click Save as Template
3. Provide a template name, description, and category
4. Set visibility to Private or Shared
5. Click Save

Creating a report from a template:

1. Click New Report from Template
2. Select a template from the list
3. Customize as needed for this specific report
4. Click Save

Duplicating reports:

To create a similar report quickly without starting from scratch:

1. Select the report to duplicate from the reports list
2. Click Duplicate
3. Modify the name and any settings as needed
4. Click Save

Marking reports as favorites:

1. Locate the report in the reports list
2. Click the Star icon to add it to your favorites
3. Access your favorite reports quickly from the Favorites tab

Best practices:

• Test new reports with a small date range before scheduling them for regular delivery
• Use descriptive names and descriptions, especially for shared reports, so other users understand the purpose without needing to open the configuration
• Use report templates for recurring report types to save setup time
• Review and clean up obsolete reports periodically to keep the reports list manageable
• For very large datasets, use grouping and aggregation to produce summary reports rather than full detail exports
• Retain compliance reports according to your organization’s regulatory requirements

[Your administrator should set up a standard library of reports for common compliance frameworks and share them with the relevant team members so everyone is working from the same baseline.]