Threat event reports

Reports are documents focusing on a specific threat event type, visualize the collected data in widgets, and enable the user to apply filters to focus on different time periods. This enables a more in-depth analysis of the specified threat.

Reports are only available to authorized users with the corresponding permissions, typically Insights Viewer user accounts.

Available reports

The data collected for the reports provide insights into both device demographics and threat event types. Threat View creates a separate report for each threat event type. Accordingly, the following reports are available:

• App in Virtual Space

• Hooking Framework

• Library Injection

• Rooted/Jailbroken

• Screen Mirroring

• Screen Recording

• Screenshot

• Untrusted Keyboard

• Untrusted Screen Reader

For more information about threat event types, see Types of monitored threats.

Filtering the data: selecting the time period

You can select the time period you want to apply to the data in the widgets via the Time period drop down menu, available in each of the reports. The time period you select applies to all widgets for the report you are currently viewing, and is displayed in most of the widgets. The text specifying the time period in the widget updates dynamically when you change the selected time period.

Threat view provide the following filter options for time periods:

• Previous 24 hours (default selection)

• Previous 7 days

• Previous 30 days

• Previous 12 months

• Previous 24 months

• Custom

  You can also select a custom time period. Threat View offers two different types of time period ranges:

  • one day in the previous 7 days

    If you select this, the Custom Time Period side bar prompts you to select an option from the Date drop down menu.

  • one week in the previous month

    If you select this, the Custom Time Period side bar prompts you to select an option from the Week drop down menu.

Threat View keeps your selected time period filter after you refresh the page. Once you log out, it resets the filter to the default value, i.e., Previous 24 hours.

If no data is available for the selected time period, the widgets display No data.

Report data: widget types

Threat View visualizes the collected data for the threat reports in different widget types, and each widget type focuses on a different aspect of the threat event data. Every report page contains the following widget types:

• Big Number for the total number of events and numbers of events on Android and on iOS: data aggregation by operating system.

• Line chart for the trend per hour of the percentage of total sessions for iOS or Android: series of events, data aggregation by operating system.

• Donut chart for the distribution in percentage for iOS sessions or Android sessions: data aggregation by operating system.

• Stacked Area charts for iOS or Android: comparison between total number of events and event per operating system.

• Vertical Bar Chart for the top 10 device models: data aggregation by device model.

Total Events and Events per operating system: Big Number widgets

The Big Number widgets show the total number of events over the selected time period, in total and per operating system. The numbers are displayed with a maximum of four digits, the scale is indicated with letters: “K” for thousand and “M” for million.

Threat Event type trends per operating system: line chart

The widget shows a line chart with the percentage of total sessions where a given threat event type occurred per operating system over a certain duration per hour for the selected time period. For instance the percentage of events with a rooted/jailbroken device out of the total number of sessions between 8:00 a.m. and 9:00 a.m. To view the graph’s data points, toggle the Show data points switch.

OS Usage: donut chart

The number of sessions per operating system where a threat event was detected over the selected time period. The donut chart presents the data in absolute numbers and as percentage, and calculates the number out of the total number of sessions. To see the percentage, hover the mouse pointer over the chart to display a tooltip with the absolute numbers and the percentage of threat events. The bi-colored ring represents the sessions where the specified threat event type occurred for each operating system, and the number in the central area of the chart shows the total number of sessions where the specified threat event type occurred.

With the dropdown menu in the widget’s top right corner you can customize the view to switch between

• the total number and percentage of sessions, both in total and per operating system

• the number and percentage of sessions where the specified threat event type occurred, both in total and per operating system.

If you toggle the legend items on the right side of the chart, you can view the threat events for the toggled operating system.

Trends for threat event type by operating system: stacked area charts

The number of a specific threat event type, i.e., the threat event type that is the subject of the selected report, compared to the total number of events. The threat event types are compared for a specific operating system for the selected time period. This widget shows the threat events for the selected type, compared to the total number of events, i.e., compared to all other threat event types, in absolute numbers. If you toggle the legend items underneath the chart, you can view the threat events only or the other threat event types only. When you hover the mouse pointer over the chart, Threat View displays a tooltip with more information.

10 device models with most detected events: vertical bar chart

The widget shows a vertical bar chart with events that occurred for the 10 device models with the most events during the selected time period. The collected data is not separated by operating system but is shown in a mixed view for both, Android and iOS. The chart displays the percentage for all threat events and the selected threat event type. When you hover the mouse pointer over the chart, Threat View displays a tooltip with both the absolute numbers and the percentage of detected threats.

For each device model, two bars are displayed: one bar for the selected threat event type, and one bar for the total number of threat events. This widget type is dynamic and the displayed device models may change, depending on the selected threat event type. The height of the bars is based on the percentage rather than total numbers of events. If any two or more models show the same percentage and/or amount of events, the chart sorts the bars alphabetically according to the device model names.

Via the dropdown menu in the widget’s top-right corner, or by toggling the legend items underneath the chart, you can customize widget to view the events for this specific threat event type only or for all threat event types only.