Stats Panel¶

The Stats panel shows statistical analysis of your result sets, displaying the distribution of values across fields. Use Stats to identify patterns, outliers, and connections within your search results.

What's included¶

The Stats panel displays:

Value distribution: Count of occurrences for each value
Visual charts: Pie charts for most data types, map for IP country
Tabular data: Sortable tables with counts
Guided pivot indicators: Highlighting for pivotable values

How Stats works¶

Stats aggregates data for the first 2,500 records in your result set. For each data type, it shows:

Number of occurrences
Percentage of total
Visual representation
Guided pivot status (if applicable)

Supported data types¶

Stats analyzes these fields from your Pivot Engine results:

IP Country: Geographic distribution (displayed as map)
Email addresses: Contact email distribution
Registrars: Domain registrar distribution
Name servers: DNS provider distribution
IP addresses: Hosting distribution
ASN: Autonomous system distribution
Tags: Domain tag distribution
Risk scores: Risk score ranges
Create dates: Registration date ranges
And more: Most Pivot Engine fields

Configure Stats¶

Sort order¶

Configure how Stats displays data:

Select the settings icon in the Stats panel.
Navigate to Sorting.
Choose sorting preference:
By count: Most common values first (default)
Alphabetically: Sort by value name
Guided pivots first: Prioritize pivotable values

Field selection¶

Control which fields appear in Stats:

Select the settings icon.
Choose which data types to display.
Reorder fields as needed.

Use Stats¶

Identify patterns¶

Look for patterns in your results:

Clustering: Many domains sharing specific values
Outliers: Unusual or unique values
Distribution: How values spread across results
Guided pivots: Highlighted values worth investigating

Pivot from Stats¶

Stats integrates with guided pivots:

Locate highlighted values (guided pivots).
Note the domain count.
Select the value to pivot.
Create a new search or filter.

Visualize data¶

Stats provides visual representations:

Pie charts: Show proportional distribution
Geographic map: Display IP country distribution
Tables: Sortable data with counts
Color coding: Highlight important values

Use cases¶

Campaign analysis¶

Identify campaign characteristics:

Shared infrastructure (IPs, name servers)
Common registrars or registrants
Geographic patterns
Risk score distribution

Threat hunting¶

Find suspicious patterns:

Unusual hosting providers
Unexpected geographic locations
Shared email addresses
Risk score clustering

Infrastructure mapping¶

Understand domain relationships:

Hosting patterns
DNS provider usage
Certificate sharing
Network distribution

Best practices¶

Efficient analysis¶

Start with guided pivots: Focus on highlighted values.
Look for clusters: Identify shared attributes.
Check distributions: Understand value spread.
Cross-reference: Compare with other panels.

Investigation workflow¶

Execute search: Populate Pivot Engine.
Open Stats: Review statistical distribution.
Identify patterns: Note interesting clusters.
Pivot on values: Investigate connections.
Document findings: Capture insights.

What to look for¶

Interesting patterns:

Small clusters (2-10 domains) sharing specific values
Unusual geographic distributions
Shared infrastructure across high-risk domains
Consistent registrar or email patterns

Red flags:

Many domains on single IP
Bulletproof hosting providers
Privacy-protected WHOIS patterns
High-risk score clustering

Limitations¶

Stats aggregates only the first 2,500 records
Large result sets may not be fully represented
Some fields may not be available for all domains
Visual charts work best with moderate value counts

Export Stats¶

Stats data is included in investigation reports:

Ensure Stats panel is visible.
Generate investigation report from Product Menu.
Stats visualizations appear in the PDF.

For more details, see Generate Investigation Reports.