Email Command Center - View a dynamic overview of your email security status in the Email Command Center. - Administrator Guide - Cortex XSIAM - Cortex

Email Command Center - View a dynamic overview of your email security status in the Email Command Center. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-11

Notice

Requires the Cortex Advanced Email Security module.

The Email Command Center provides an interactive overview of your email security status that offers comprehensive visibility and control over email security threats and responses in your organization. With real-time insights and actionable intelligence, you can stay ahead of threats and make informed decisions with ease and confidence.

In the face of sophisticated AI-driven phishing attacks and other social engineering tactics, the Email Command Center is essential for ensuring organizational security. It moves beyond isolated email analysis to offer a holistic view of potential attack chains, enabling proactive protection and rapid response. With drill-down capabilities, reveal detailed metrics and insights for deeper analysis and proactive threat management.

Access the Email Command Center in Modules → Email Security.

Select a time frame for a visualization of the different components that make up the current risk status of your domains. You can select between Last 24 hours, 7 days, or 30 days. The default time frame is 30 days.

The Email Command Center is made up of the following components:

View general information about the email security status of your organization in an intuitive, interactive flow diagram. You can drill down to the details to get a comprehensive understanding of the email security status of your organization. The diagram is made up of the following sections:

Metrics about incoming data.
- Identities
- General email metrics: Numbers of scanned emails, domains, mail boxes, detected attachments and links.
  - Click Attachments to display the Files Breakdown table on the right.
  - Click Links to display the URL Reputation table on the right.
- Endpoints: Information coming from Cortex XDR Agents.
- Network data
Note
Adding more data into the Email Security module will ensure better detection of complicated email threat vectors.
Metrics about the issues and cases generated by the module. The module groups related issues into a single case to give context. Click anywhere in this area to open the Trends and Metrics widgets on the right.
Under this section is a carousel that summarizes the remediation actions that were taken.
Metrics about the automated and manual remediation actions that were taken, including a breakdown of resolved and open cases. Click Resolved Cases or Open Cases to see a breakdown of cases that were generated manually and by automation.

The tables and widgets displayed on the right about the general insights. To return back to the general insights, click Back to Overview.

Trending Attack Vectors: Details the type of identified attacks in the issues, with a description and the number of issues associated with each attack type. The percentage represents the change from the previous time frame, where red is an increase in attacks and green is a decrease. For example, if the attack count for the last 30 days is 6, and the percentage is 50%, in the previous 30 day time frame, there were 4 attacks, and in the current 30 day time frame there were 2 additional attacks.
Click a row to display the Issues table filtered by the specific attack type.
Mailboxes: Surfaces statistics about the coverage of the emails boxes and email directionality. Mailboxes Coverage shows the numbers for the following mailboxes: User, Shared, Room, Uncovered, Other. Under Email Directionality, you can see how many total emails were scanned, how many were inbound or outbound, and how many were internal.
URL Reputation: Groups the links according to category, and provides the number of identified links in the current time frame and the number of links in the previous time frame. Each category is made up of a number of different types of link, grouped together under a descriptive title. The numbers inside the parentheses represent the number of malicious links. Click a row that references a malicious link to see the issues that are generated from the emails that contain the links in the category.
Files Breakdown: Categorizes the detected files according to file family type, and provides the number of attached files in the current time frame and the number of attached files in the previous time frame. Each family type is made up of a number of different file types, grouped together under a descriptive title. The numbers inside the parentheses represent the number of malicious files. Click a row to see the issues that are generated from the emails that contain the file types in the file family.
Top Cases by Smartscore: Presents the top ten cases listed in order of descending smartscore, with a description and the number of impacted endpoints and users. The smartscore is displayed in a box with colors that represent the severity.
Click a row to see the case in detail.
Remediation: Displays the remediation actions taken by the Email Security engine. Each row details the number of remediated emails, the number of remediation actions taken, and the detected errors. From each row, you can pivot to the Remediation Action Center.
When there's no rule in the policy that triggers a remediation action, the action is marked as Not Active in this table. Click Configure to define a rule that triggers this action.
Note
The number of remediated emails and the number of remediation actions may not always be equal. This is due to a number of reasons, including different policies that affect the email messages or manual actions taken.

The widgets displayed on the bottom right of the Trends and Metric widgets provide information and enable drilldown to different parts of the system.

Issues Over Time: Graph displaying the number of issues at each given point in the selected time frame. Click each section in the chart to view the Issues table filtered according to the selected time frame of the section.
Risky Users: The number of users that were detected as being risky. The percentage represents the increase or decrease compared to the previous time frame.
This widget also displays the top five risky users in descending order of risk score, together with their title in the organization, and the number of risky emails per user. If you have the ITDR module, the normalized risk score is displayed, and the email numbers and the risk score will be color coded to represent the severity of the risk.
Click a user to open the User view.

Notice

Note

Note