Dashboard
The Dashboard is your real-time security posture summary. It aggregates data from DynamoDB to give you an at-a-glance view of threat activity, response coverage, and recent events — without requiring you to dig through individual finding logs.
In the app: /
KPI Cards
Four metric cards at the top of the page summarize the current state of your environment: total active (enabled) threat rules, GuardDuty events captured in the last 24 hours, entities currently blocked by an active BLOCK policy, and IAM credentials that have been revoked. These numbers update each time you load the page.
Threat Timeline
A bar chart showing the number of GuardDuty findings per day over a selectable window (7 days, 14 days, or 30 days). Each bar represents one calendar day in UTC.
Use this chart to correlate finding spikes with specific events in your infrastructure: a new deployment, a penetration test, a change in network topology, or an actual incident. A sudden spike on a day with no known change is worth investigating in the Events log.
Severity Distribution
A donut chart breaking down all processed findings into Critical, High, Medium, and Low severity buckets. A healthy environment has the vast majority of findings in Low/Medium, with zero or very few Critical items. If Critical findings are accumulating, check the Threats page to ensure those finding types are set to BLOCK or REVOKE rather than REPORT.
Response Action Breakdown
A second donut chart showing what fraction of your configured threat rules are set to each action: IGNORE, REPORT, BLOCK, REVOKE, SAVE. This gives a quick read on your response coverage. Ideally, all Critical-severity rules should be on BLOCK or REVOKE, and nothing should be on IGNORE unless you have a deliberate reason.
Recent Events
A table of the 10 most recent security events, newest first. Each row shows the timestamp (UTC), finding type, severity badge, and actor summary. Click any row to navigate to the Events page. This panel is most useful for spotting brand-new activity without leaving the dashboard.
Top Threats
A ranked list of the most frequently triggered finding types. A finding type appearing here hundreds of times may indicate either a noisy low-value detector (consider IGNORE) or a real persistent threat (consider BLOCK). Cross-reference with the severity and actor details in the Events page to decide which.
Demo Mode
Append ?showDemoData=true to the app URL to populate the dashboard with synthetic sample data. Useful for onboarding new team members or testing the UI before GuardDuty has produced real findings.
ℹ️ Note
All dashboard data is read from DynamoDB. If the dashboard shows zeros but you know GuardDuty is active, check that the EventBridge rule in your CloudFormation stack is enabled and that the EventsProcessor Lambda has not been throttled.
💡 Tip
Switch to the 30-day window and look for slow trends rather than daily spikes — a gradual increase in Low-severity findings over a month can indicate a persistent low-and-slow recon campaign.