Using Coro Insights
Admin users with sufficient permissions can view insights for their workspace using the Coro Insights page.
Important
Managed Service Provider (MSP) admin users with sufficient permissions can view and monitor aggregated security activity from the past 30 days across their organization's parent and descendant workspaces using the global Coro Insights page.
Use the panels in the following sections to explore incidents, identify patterns, and drill down into related tickets from each summary:
User insights
Important
Your workspace must have Coro User Data Governance enabled to view access permission violation information.
Use the User insights section to view protected users with the highest ticket volumes or repeated access permission violations over the past 30 days.
The User insights section includes the following panels:
| Panel | Description | Actions |
|---|---|---|
| Top 5 Ticketed Users | Shows protected users in your workspace who triggered the most tickets over the past 30 days. The panel shows the user's name, email address, and their total ticket count. |
Select a user to open the Ticket Log showing their tickets from the past 30 days. |
| Top 5 Access Permission Violators | Shows protected users in your workspace with repeated access permission violations over the past 30 days. The panel shows the user's name, email address, and their total User Data Governance ticket count. |
Select a user to open the Ticket Log showing their tickets from the past 30 days. |
In global view, the User insights section includes the following panels:
| Panel | Description | Actions |
|---|---|---|
| Top 5 Ticketed Users | Shows the protected users in your organization's workspaces who triggered the most tickets in the past 30 days. The panel displays each user's name, email address, workspace name, and their total ticket count. |
Select a user to open the Global Ticket Log showing their tickets from the past 30 days. |
| Top 5 Access Permission Violators | Shows the protected users in your organization's workspaces with the most repeated access permission violations in the past 30 days. The panel displays each user's name, email address, workspace name, and their total User Data Governance ticket count. |
Select a user to open the Global Ticket Log showing their tickets from the past 30 days. |
Ticket insights
Use the Ticket insights section to monitor ticket trends and identify the most frequent ticket types created over the past 30 days.
The Ticket insights section includes the following panels:
| Panel | Description | Actions |
|---|---|---|
| Tickets | Shows the total number of tickets Coro created in your workspace over the past 30 days, and a percentage trend from the previous month. The Most common ticket type list shows the top ticket categories by volume, including the ticket count and each category's percentage of total tickets in the workspace. |
Select a ticket type to open the Ticket Log filtered by that type for the past 30 days. Select View all to open the Ticket Log for all tickets that Coro created in your workspace over the past 30 days. |
In global view, the Ticket insights section includes the following panels:
| Panel | Description | Actions |
|---|---|---|
| Tickets | Shows the total number of tickets Coro created across your organization's workspaces over the past 30 days, and a percentage trend from the previous month. The Most common ticket types across workspaces list shows the top ticket categories by volume, including the number of affected workspaces, total ticket counts, and each category's percentage of tickets across all workspaces. |
Select a ticket type to open the Global Ticket Log filtered by that type for the past 30 days. Select View all to open the Global Ticket Log for all tickets that Coro created across all workspaces over the past 30 days. |
Automated remediation insights
Use the Automated remediation insights section to review the number of tickets automatically closed by Coro in the past 30 days, grouped by module, with monthly trend data.
The Automated remediation insights includes the following panel:
| Panel | Description | Actions |
|---|---|---|
| Auto-Resolved Tickets by Module | Shows a chart and list of tickets automatically resolved by Coro from the past 30 days, grouped by module, with a percentage trend compared to the previous month. |
Select View all to open the Ticket Log for all tickets that Coro closed in your workspace over the past 30 days. Hover over a chart segment to see the number of tickets Coro automatically resolved for that module. |
In global view, the Automated remediation insights section includes the following panel:
| Panel | Description | Actions |
|---|---|---|
| Auto-Resolved Tickets by Module | Shows a chart and list of tickets automatically resolved by Coro across your organization's workspaces from the past 30 days, grouped by module, with a percentage trend compared to the previous month. |
Select View all to open the Global Ticket Log for all tickets that Coro closed across all workspaces over the past 30 days. Hover over a chart segment to see the number of tickets Coro automatically resolved for that module. |
Email security insights
Use the Email security insights section to track domains that triggered the most Email Security tickets and assess changes in email threat activity.
Important
You can view the Email security insights section in workspace view, and only if your workspace has Coro Email Security enabled.
The Email security insights section includes the following panel:
| Panel | Description | Actions |
|---|---|---|
| Top Domains Flagged for Suspicious Emails | Shows the email domains that triggered the highest number of Email Security tickets in your workspace over the past 30 days. The panel displays each domain, the number of email security tickets Coro created, and the percentage trend compared to the previous 30 days. |
Select a domain to open the Ticket Log filtered by that domain. Select View all to open the Ticket Log for all Email Security tickets that Coro created in your workspace over the past 30 days. |
