You can further refine the search to monitor hits from processevent event types, grouping by unique process names. Then, create a dashboard from the result so that you can easily recall the visualization with updated data. You can update your query, either by drilling down in the Helix Web UI, or by modifying the search text for the following: has(class) class=fireeye_hx_ioc eventtype=processevent | groupby process. This should display a list of processes that are correlated to the hits being generated in your Endpoint Security environment. To build the dashboard from these results, do the following:
Copy the search text to your clipboard.
On the Dashboards menu, select Custom.
Select the Create Dashboard button on the top right edge of the Dashboards list.
Complete the fields of the Create New Dashboard form.
Select Create.
Select Add Widget.
Choose a Pie chart on the Details tab.
Adjust the other properties to your needs.
Select Save.
.jpg "Helix_dashboard_1.jpg")