Build your own Web Security Analytics dashboard to display the data you need. Add filters and select dates to get more focused results. View the activity logged by your security products and review the alarm notifications.

Statistics view

When you navigate to Web Security Analytics for the first time, the Statistics view is selected by default. It displays a reference widget that visualizes request volume over time, with traffic broken down by the Attack Type dimension. The widget shows:

• A total request count for the selected time range and dimension, based on applied filters.
• A time-series chart showing the average number of requests per time interval, based on the selected time range. Hover over the chart to view the exact request count for a specific interval. Background colors represent alert priorities. When multiple priorities occur within the same time interval, the visible color reflects the topmost layer in the chart and may not indicate a single priority.
• A table beneath the chart that breaks down requests in more detail and shows both exact request counts and their distribution over time.

The total number of requests and the chart values update dynamically when you change the dimension. Each dimension groups and counts requests differently, which can result in different totals for the same range. For example, when the dimension is set to Rule Action, the widget counts requests by the actions applied to them, such as allow or deny. When the dimension is set to Attack Type, the widget displays only requests classified under specific attack categories and shows their distribution.

Requests are HTTP requests detected by Web Security Analytics. These requests triggered security controls in the selected security configuration and are scoped by the chosen dimension and filters.

The reference widget in the Statistics view serves as a starting point for building a custom dashboard. You can add additional widgets based on different dimensions and choose how they are displayed. You can also click the All views dropdown and select the Multi-dimension view.

Add widgets

Create a dashboard from selected widgets, that is individual content panels, each displaying a specific dimension.

1. Go to ☰ > WEB & DATA CENTER SECURITY > Security Center.

2. In the left menu, click Analysis > Web Security Analytics.
   First time you come here you can see one widget displaying Requests by Attack Type as a column chart and a table, but it's just a start. Think which dimensions you use most often.

3. To add a widget, click the icon, mouse over a dimension and click how you want to visualize your data:

   • line chart
   • column chart
   • table
   • pie chart

The widget appears on your dashboard.

Manage widgets

Adjust the dashboard layout.

• to move a widget, hover over its header until the cursor changes shape to and then click and drag the widget to where you want it
• to change the size of a widget, place the cursor on the widget's border, click and drag to resize

Adjust individual widget settings

Each widget displays request activity for security events. You can view the data as a table or as a time series chart, and group it by different dimensions, for example Attack Type.

Display options

Each widget supports multiple display modes. To change the way the data is displayed, click More actions in the corner of a widget and select:

• Table to display request data grouped by the chosen dimension, total number of requests in the selected time period, and request distribution (a visualization showing the relative distribution of requests across the chosen dimension). In this display type, you can filter the data by clicking the table headers.

In the Table view, the Distribution column supports two visualization types to represent request distribution. Choose the visualization that best fits your analysis needs:

• Distribution as a line. Line charts emphasize continuity across data points, which can help with comparing proportions and understanding how request distributions evolve over time. By explicitly representing gaps caused by low-volume traffic, line charts now provide clearer context during investigations and help you better interpret sparse or intermittent request patterns. Even when request counts are small, the line confirms that activity exists, helping you avoid false assumptions and missed signals. You can switch the request distribution view per widget by clicking its More actions button and selecting Distribution as a line:

The widget then updates to display the distribution as a line chart:

• Distribution as a column. Displays request distribution as columns. It is useful for comparing relative request volumes and emphasizes differences between individual values. You can switch the request distribution view per widget by clicking its More actions button and selecting Distribution as a column.
• Time series line to display request activity over time as a line chart. Hovering over the chart shows the request count for a specific time interval. Background colors represent alert priorities. When multiple priorities occur within the same time interval, the visible color reflects the topmost layer in the chart and may not indicate a single priority.
• Time series column to display the same time-based data using columns.
• Pie chart to display the same time-based data. The chart shows up to five categories, additional values are grouped under Other.

You can perform additional actions on a widget to customize its display and behavior:

1. To change the dimension, click the current dimension label in the widget and select a different one from the list.
2. To remove a widget, click in the corner of a widget and click Remove from View.
3. To duplicate a widget, click in the corner of a widget and click Duplicate.
4. To adjust the display of a table widget, hover over a table column header to see the menu icon. Use this menu to:
   • pin the column to the left or to the right
   • autosize one or all the columns
   • reset columns.

Interact with widgets

If you work with table widgets:

• right-click a table cell or a range of cells to open a menu that lets you:

  • Copy the contents (with or without column headers).
  • Export the contents to a CSV file.

• search for a specific entry in the Search box. The table displays only the rows that contain the phrase.

If you work with line chart and bar chart widgets:

• Hover your mouse over the chart to display the average number of requests per second at a specific point in time.
• Click on the timeline and drag to zoom in on a selected time period. To zoom out use the icon.

To download the data displayed in any widget as .csv, click More actions and select Export.

By default, all data in the widget is grouped by a single dimension. You can see the dimension in the widget header. To analyze requests across two dimensions at once:

1. In the widget header, click Create pivot view icon.

2. Select:

   1. Attack Type to break down the analysis by the individual attack types.

   2. Action Applied to break down the analysis by an action your security products applied to requests, such as Monitor or Deny.

   3. Action Type to break down the analysis by an action you set in a security policy to take against requests.

      1. Monitor, alert and allow actions are grouped under Monitor.
      2. All other actions, for example deny, are grouped under Mitigate.

   4. Policy to break down the analysis by a security policy which evaluated the requests.

   5. Status Code to view request data by status code.

   6. None to return to a single-dimension breakdown.

What’s next?

To control which requests are included in Web Security Analytics see Set report scope.

To narrow results based on specific conditions, see Filters.