FalconForce FalconDash

FalconDash is an open-source Azure workbook dashboard built to support detection engineering maintenance and tuning. It collects security alert data from Microsoft Sentinel, based on underlying detection queries, and presents the data in a centralized view for detection engineers and security teams. The dashboard displays detection trigger time-series data (trend analysis) so users can identify anomalies, spikes, drops, or recurring patterns such as consistent, persistent, escalating, or periodic activity in detection triggers. It also provides entity mapping analysis, allowing users to click into a specific detection and view the entities that contributed to generated alerts, which supports creation of exclusions and tuning decisions. Configurable variables include lookback period, data provider, alert filter regex (include/exclude), number of alerts to display, and detection type (custom, out-of-the-box, or both). The dashboard is extensible and can be enriched with additional data sources and custom metadata, such as SOC classification data from ServiceNow, to support prioritization of detections that require attention. The underlying detection trigger visualization is powered by KQL queries using the make-series operator against the SecurityAlert table in Microsoft Sentinel.