Top X groups matching events and calculates a metric for each group. Use it to find busy devices, accounts associated with multiple devices, common networks, numeric distributions, or changes over time.
Choose the calculation
| Dashboard Add Card entry | Find the… setting | What it answers |
|---|---|---|
| Top X Distinct Count | Distinct Count Of | How many different values of the measured attribute occur in each group? |
| Statistics of Value | Statistics Of | What are the minimum, maximum, average or selected quantiles of a numeric attribute? |
| Velocity of Value | Velocity Of | How many matching events occur per time bucket and group? |
| Velocity of Signal | Signal Velocity Of | How often do selected signals occur across the selected period? |
| Velocity of Signal over Time | Signal Velocity Over Time | How do those signal counts change over time? |
| Attribute Flow | Attribute Flow | How do values in an ordered set of attributes relate within matching events? |
In Investigations, select Top X and choose the calculation in the widget's settings. The shared settings work in both contexts.
Configure the event population
- Open the card's settings.
- Under Calculation, choose Find the….
- Set With the same (group by)… to the attributes that define a group. Multiple attributes define combinations: device plus country is a different question from device alone.
- Where shown, choose the Attribute to measure. In a distinct-count query, this is the value being counted, not the grouping key.
- Under Events, leave All event types selected or choose Select specific event types and select the required types.
- Add a Filter when the query should include only a step, outcome or other condition.
- Set a threshold and Maximum Results.
- Preview, review the population and counts, then save.
Use the attribute pickers to select valid names for your node. Contexts are significant: the primary connection's IP address and a different connection context are separate attributes.
The card also receives its surrounding query context: the board's visual filter in Dashboards, or the executed query in Investigations. Check that context as well as the card's Filter and event-type selections when defining the event population.
Worked example: devices used for more than five accounts
Use a stable account identifier that your integration actually supplies. This example uses:
| Setting | Value |
|---|---|
| Find the… | Distinct Count Of |
| With the same | device_signature['VER_1'].identifier |
| Attribute | identity['ACCOUNT'].customer_token.customer_token |
| Event types | All event types |
| Filter | step_name = 'login_submit' |
| Threshold | Greater than value; Min = 5 |
| Maximum Results | 50 |
The resulting number is distinct customer tokens per device signature during the selected period. Six qualifying accounts pass a “greater than 5” threshold; five do not. This is not the number of login attempts and is not proof of account takeover.
To reverse the question, group by customer token and count distinct device signatures. To count login events per device, use identifier as the measured attribute: each event has its own identifier.
Thresholds and result limits
Always displays qualifying groups without a numeric threshold where that calculation supports it. Greater than value and Less than value use strict comparisons. Between values uses the specified bounds. Velocity of Value requires a threshold; Greater than 0 is a useful starting point for showing activity.
For Statistics Of, configure thresholds against the selected statistics, rather than assuming one threshold applies to every statistic.
Maximum Results accepts 1–1,000 in the UI examined for this guide. This limits the returned groups/results; it does not limit the number of events examined to calculate them. A top-results view is not an exhaustive inventory. Reduce grouping complexity or narrow the event population when the results are too large.
Numeric statistics
Choose Statistics Of, select a numeric attribute, then select Min, Max, Avg or Quantile. Quantile 0.5 is the median; 0.95 is the 95th percentile. Several statistics can be selected for an attribute.
The example below groups duration by step_name and calculates its average. Confirm the attribute's documented units before labelling a chart; do not assume every duration or amount uses the same unit.
Virtual grouping columns
Select Add virtual column beneath the group-by picker to group by a query expression instead of a stored attribute alone. Enter an expression supported by the query language and preview it before saving. For example, a Boolean condition can separate events into two groups.
Virtual grouping columns are calculated for the analysis. They do not add a collected field to historical events. Use the existing attribute picker when an ordinary attribute already answers the question.
Follow a result into Investigations
On supported distinct-count table values, hover to open Search for events (this column) or Search for events (this row). The column action uses that value; the row action combines the grouping values from the row.
Check the generated query and dates before searching. Add the original card's event-type and filter restrictions where needed: a grouping-value link alone may select a broader event population than the original card.
For shared IP addresses, missing identifiers or changing device signatures, inspect representative events before treating a high count as suspicious activity.