Security Dashboard

Basic functions and how to open Security Dashboard

The Security & Compliance Center enables your organization to manage data protection and compliance. Assuming you have the necessary permissions, the Security Dashboard enables you to review your Threat Protection Status, as well as view and act on security alerts.

Watch the video to get an overview, and then read this article to learn more.

Depending on what your organization's subscription includes, the Security Dashboard includes several widgets, such as Threat Management Summary, Threat Protection Status, Global Weekly Threat Detections, Malware, and more, as described in the following sections.

To view the Security Dashboard, in the Security & Compliance Center, go to Threat management > Dashboard.

Note

You must be a global administrator, a security administrator, or a security reader to view the Security Dashboard. Some widgets require additional permissions to view. To learn more, see Permissions in the Security & Compliance Center.

Threat Management Summary

The Threat Management Summary widget tells you at a glance how your organization was protected from threats over the past seven (7) days.

Security Dashboard - Threat Management Summary widget

The information you'll see in the Threat Management Summary depends on what you subscription includes. The following table describes what information is included for Office 365 E3 and Office 365 E5.

Office 365 E3 Office 365 E5
Malware messages blocked
Phishing messages blocked
Messages reported by users



Malware messages blocked
Phishing messages blocked
Messages reported by users
Zero-day malware blocked
Advanced phishing messages detected
Malicious URLs blocked

To view or access the Threat Management Summary widget, you must have permissions to view Advanced Threat Protection reports. To learn more, see What permissions are needed to view the ATP reports?

Threat Protection Status

The Threat Protection Status widget shows threat protection effectiveness with a trending and detailed view of phish and malware.

Threat protection status widget

The details depend on whether your Microsoft 365 subscription includes Exchange Online Protection (EOP) with or without Office 365 Advanced Threat Protection (ATP).

If your subscription includes... You'll see these details
EOP but not Office 365 ATP Malicious email that was detected and blocked by EOP.

See Threat Protection Status report (EOP).
Office 365 ATP Malicious content and malicious email detected and blocked by EOP and Office 365 ATP

Aggregated count of unique email messages with malicious content blocked by the anti-malware engine, zero-hour auto purge, and ATP features (including Safe Links, Safe Attachments, and ATP anti-phishing).

See Threat Protection Status report (ATP).

To view or access the Threat Protection Status widget, you must have permissions to view Advanced Threat Protection reports. To learn more, see What permissions are needed to view the ATP reports?

Global Weekly Threat Detections

The Global Weekly Threat Detections widget shows how many threats were detected in email messages over the past seven (7) days.

Global Weekly Threat Detections widget

The metrics are calculated as described in the following table:

Metric How it's calculated
Messages scanned Number of email messages scanned multiplied by the number of recipients
Threats stopped Number of email messages identified as containing malware multiplied by the number of recipients
Blocked by ATP Number of email messages blocked by ATP multiplied by the number of recipients
Removed after delivery Number of messages removed by zero-hour auto purge multiplied by the number of recipients

Malware

Malware widgets show details about malware trends and malware family types over the past seven (7) days.

Malware trends and family types

Insights

Insights not only surface key issues you should review, they also include recommendations and actions to consider.

Smart insights

For example, you might see that phishing email messages are being delivered because some users have disabled their junk mail options. To learn more about how insights work, see Reports and insights in the Security & Compliance Center.

Threat investigation and response

If your organization's subscription includes Office 365 Advanced Threat Protection Plan 2, your Security Dashboard has a section that includes advanced threat investigation and response tools. These tools include automated investigation and response capabilities. Automated investigation and response can be helpful in scenarios such as addressing compromised user accounts quickly.

To learn more, see Get started using Automated investigation and response (AIR) in Office 365.

Near the bottom of the Security Dashboard is a Trends section, which summarizes email flow trends for your organization. Reports provide information about email categorized as spam, malware, phishing attempts, and good email. Click a tile to view more detailed information in the report.

The Trends section summarizes email flow trends for the organization

And, if your organization's subscription includes Office 365 Advanced Threat Protection Plan 2, you will also have a Recent threat management alerts report in this section that enables your security team to view and take action on high-priority security alerts.

To view or access the Sent and Received Email widget, you must have permissions to view Advanced Threat Protection reports. To learn more, see What permissions are needed to view the ATP reports?.

To view or access the Recent Threat Management Alerts widget, you must have permissions to view alerts. To learn more, see RBAC permissions required to view alerts.

View email security reports in the Security & Compliance Center

View reports for Office 365 Advanced Threat Protection

Office 365 Advanced Threat Protection

Office 365 Threat investigation and response