The dashboard screen provides an overview of the email activity observed by Defend. This information is displayed in easy-to-read graphs and charts. A side menu also allows you to navigate to other areas of the portal.

Navigation Menu

By selecting the navigation menu in the top-left corner of the page, you can access other KnowBe4 products, including Prevent, Security Awareness Training, and PhishER. For more information, see our Login Page and Navigation Menu Overview article.

Timeline

By default, the timeline displayed is two weeks before the current date. 

This section can be altered at the top-right corner of the screen with the following settings:

• Day
• Week
• Month
• Quarter
• Year
• Custom Range

Security Posture

At the top of the Dashboard screen, the Security Posture card displays counts and trends for the selected timeline.

Email Totals

At the top of the Security Posture card, a selection of boxes displays counts and trends for the selected timeline.

The Emails Processed card shows the total number of emails Defend analyzed during the selected time period.

The Dangerous Emails and Suspicious Emails cards are clickable. Selecting either takes you to a filtered view of the Recent Emails page and shows you the individual emails detected in the time period. You can select these emails to see more information.

Productivity Tools

The Productivity card combines counts of emails that were flagged as spam or graymail. This helps you understand how much of your organization's total email volume reduces productivity.

The Productivity Savings option shows the estimated time and money your organization saved by filtering spam and graymail. This metric helps you quantify the return on investment (ROI) of your email security.

We calculate the time saved by multiplying the number of filtered emails by the average time saved per email. The card dynamically displays this value in seconds, minutes, hours, or days. We calculate the cost saved by multiplying the total time saved by the average employee's hourly wage.

The Message Threats card shows the total number of messages Defend scanned during the selected time period and how many were confirmed as threats.

Dangerous or Suspicious Emails Received

This chart displays the count of emails classed as Dangerous, Suspicious, Spam, or Graymail for the selected timeframe, broken down by category so that you can compare volume across all four classifications in one view. The data points are interactive. Clicking a bar segment will take you to a filtered view in Recent Emails.

Phishing Heat Maps

The Dangerous Email Activity and Suspicious Email Activity heat maps visualize the frequency of phishing attempts received by your organization. These charts help you identify peak volume periods so you can improve your security response strategy.

• Dangerous Email Activity: This heatmap shows when dangerous emails arrive. Brighter cells highlight peak times for your organization, helping you spot patterns across the week.
• Suspicious Email Activity: This heatmap shows when suspicious emails arrive. Brighter cells highlight peak times for your organization, helping you spot patterns across the week.

The heat maps display data aggregated by the hour of the day for your selected time period.

• Time Zones: All times are automatically adjusted to your specific time zone.
• Color Scale: The intensity of the color in each block reflects the volume ratio for that specific hour. Darker colors indicate a higher volume of emails received.
• Averages: The data represents averages over the selected date range. Because these are averages, the individual blocks are not clickable and do not link to the Recent Emails page.

Threat Feed

The Threat Feed displays events related to Dangerous or Suspicious emails and provides a synopsis of activity. An example of this would be: “User has clicked a link in a Dangerous email”. Use the Email activity and Abuse mailbox tabs to filter which events the Threat Feed shows.

Select the arrow on the right of the activity to go to a filtered view of recent emails for further analysis.

Types of Phishing Emails Received

This graph displays the various types of phishing emails detected by Defend. Clicking on the question mark icon provides more information about the different classifications of emails.

Types of Payloads in Phishing Emails

This graph shows the different types of payloads identified in phishing emails detected by Defend. 

Supply Chain Health

This graph shows the current timeline of authentication status for all received emails, broken down by SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). Each incoming email is checked against the sending domain's authentication and policy records, which helps protect the domain from being spoofed. Phishing simulation tests aren't included in this data. 

• SPF: Confirms the email was sent from an IP address authorized by the sending domain. 
• DKIM: Confirms the message was signed by the sending domain and wasn't altered in transit. 
• DMARC: The sending domain's policy for handling mail that fails SPF or DKIM.

Each protocol is broken down into the following statuses:

• Pass: Authentication passed. 
• Fail: Authentication was present but failed. 
• None: No authentication was present. Other: An error occurred, or the result was unrecognized.

Top Attack Origins

This graph shows which countries the dangerous emails were sent from. Each email classified as Dangerous is traced to the country it was sent from using the sender's IP address, and the ranking shows where the most attacks originate.

Unknown: The sender's location couldn't be determined from its IP address.

Top Malicious File Types

This graph shows the most common file types found attached to dangerous emails. Each email classified as Dangerous is checked for the file types of its attachments, and the top 10 are ranked by volume. Use this to see which attachment formats attackers are targeting your organization with the most.

Other: File types outside the tracked list, grouped together.

Top Impersonated Brands

This graph shows the brands most frequently impersonated in dangerous emails. Each email classified as Dangerous is checked for the brand it's impersonating, and the top 10 are ranked by volume. Attackers imitate trusted brands to trick recipients, so this helps you see which brands are being spoofed most often against your organization.