# Viewing and interacting with Detective profile panels
Each entity profile on the Amazon Detective console consists of a set of profile panels. A profile panel is a visualization that provides general details or highlights specific activity associated with an entity. Profile panels use different types of visualizations to present different types of information. They can also provide links to additional details or to other profiles.
Each profile panel is intended to help analysts find answers to specific questions about entities and their associated activity. The answers to those questions help lead to a conclusion about whether the activity represents a genuine threat.
Profile panels use different types of visualizations to present different types of information.
## Types of information on a profile panel
Profile panels typically provide the following types of data.
| Panel data type | Description |
| --- | --- |
| High-level information about a finding or entity | The simplest type of panel provides some basic information about an entity. Examples of information included on an information panel include the identifier, name, type, and creation date. ![\[Example of a profile panel containing high-level information about an entity.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_item_details.png) Most entity profiles contain an information panel for that entity. |
| General summary of activity over time | Displays a summary of activity for an entity over time. This type of panel provides an overall view of how an entity is behaving during the scope time. ![\[Example of a profile panel containing an overview of activity over time for an entity.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_activity_summary.png) Here are some examples of summary data provided on Detective profile panels: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/detective/latest/userguide/profile-panels.html) |
| Summary of activity grouped by values | Displays a summary of activity for an entity, grouped by specific values. You can see this type of profile panel on the profile for an EC2 instance. The profile panel shows the average volume of VPC flow log data to and from an EC2 instance for common ports that are associated with specific types of services. ![\[Example of a profile panel showing a summary of activity grouped by specific values.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_grouped_summary.png) |
| Activity that only started during the scope time | During an investigation, it is valuable to see what activity only began to occur during a specific time frame. For example, are there API calls, geographic locations, or user agents that were not seen before? ![\[Example of a profile panel that highlights activity not observed before the scope time.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_newly_observed.png) If the behavior graph is still in training mode, the profile panel displays a notification message. The message is removed when the behavior graph has accumulated at least two weeks of data. For more information about training mode, see [Training period for new Detective behavior graphs](detective-data-training-period.md). |
| Activity that changed significantly during the scope time | Similar to the new activity panels, profile panels can also display activity that changed significantly during the scope time. For example, a user might regularly issue a certain API call a few times a week. If the same user suddenly issues the same call multiple times in a single day, that might be evidence of malicious activity. ![\[Example of a profile panel showing activity that changed significantly during the scope time.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_changed_activity.png) If the behavior graph is still in training mode, the profile panel displays a notification message. The message is removed when the behavior graph has accumulated at least two weeks of data. For more information about training mode, see [Training period for new Detective behavior graphs](detective-data-training-period.md). |
# Types of profile panel visualizations
Profile panel content can take one of the following forms.
| Visualization type | Description |
| --- | --- |
| Key-value pairs | The simplest type of visualization is a set of key-value pairs. A finding or entity information panel is the most common example of a key-value pair panel. ![\[Example of a profile panel containing key-value pairs.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_key_value.png) Key-value pairs can also be used to add additional information to other types of panels. From a key-value pair panel, if a value is an identifier of an entity, then you can pivot to its profile. |
| Table | A table is a simple multiple-column list of items. ![\[Example of a profile panel containing a simple table.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_table.png) You can sort, filter, and page through the table. You can change the number of entries to display on each page. See [Setting the preferences for a profile panel](profile-panel-preferences.md). If a value in the table is an identifier of an entity, then you can pivot to its profile. |
| Timeline | A timeline visualization shows an aggregated value for defined intervals over time. ![\[Example of a profile panel containing timelines.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_timeline.png) The timeline highlights the current scope time, and includes additional peripheral time before and after the scope time. The peripheral time provides context for the activity in the scope time. Hover over a time interval to display a summary of the data for that time interval. |
| Expandable table | An expandable table combines tables and timelines. ![\[Example of a profile panel containing an expandable table.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_expandable_table.png) The visualization starts as a table. You can sort, filter, and page through the table. You can change the number of entries to display on each page. See [Setting the preferences for a profile panel](profile-panel-preferences.md). You can then expand each row to show a timeline visualization specific to that row. |
| Bar chart | A bar chart shows values based on groupings. Depending on the chart, you might be able to choose a bar to display a timeline of related activity. ![\[Example of a profile panel containing a bar chart.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_bar_chart.png) |
| Geolocation chart | A geolocation chart displays a map that is marked to highlight data based on geographic location. It may be followed by a table containing details about individual geolocations. ![\[Example of a profile panel containing a geolocation chart.\]](http://docs.aws.amazon.com/detective/latest/userguide/images/screen_profile_panel_geolocation.png) Note that when processing incoming geographic data, Detective rounds the latitude and longitude values to a single decimal point. |
## Notes on profile panel content
When viewing the content of a profile panel, be aware of the following items:
****Approximate count data warning****
This warning indicates that items with extremely low counts do not appear due to the volume of applicable data.
To ensure a completely accurate count, reduce the amount of data. The simplest way to do that is to reduce the length of the scope time. See [Managing the scope time](scope-time-managing.md).
****Rounding for geographic locations****
Detective rounds all latitude and longitude values to a single decimal point.
**Changes to how Detective represents API calls**
Beginning on July 14, 2021, Detective tracks the service that made each API call. Whenever Detective displays an API method, it also displays the associated service. On profile panels that display information about API calls, the calls are always grouped by the service. For data that Detective ingested before that date, the service name is listed as **Unknown service**.
Also beginning on July 14, 2021, for accounts and roles, the activity details for the **Overall API call volume** profile panel no longer show the AKID of the resource that issued the call. For accounts, Detective displays the identifier of the principal (user or role) that issued the call. For roles, Detective displays the identifier of the role session. For data that Detective ingested before July 14, 2021, the identifier is listed as **Unknown resource**.
For profile panels that display a list of API calls, the associated timeline highlights the period of time during which this transition occurred. The highlight starts on July 14, 2021, and ends when the update was fully propagated in Detective.
# Setting the preferences for a profile panel
For profile panels, you can customize the number of rows that appear on each page on profile panels by and configure the timestamp format preference.
## Setting the table length
For profile panels that contain tables or expandable tables, you can configure the number of rows to display on each page.
Set your preference for the number of entries on each page.
1. Open the Amazon Detective console at [https://console.aws.amazon.com/detective/](https://console.aws.amazon.com/detective/).
1. In the Detective navigation pane, under **Settings**, choose **Preferences**.
1. On the **Preferences** page, under **Table length**, click **Edit**.
1. Choose the number of table rows you want to display on each page.
1. Choose **Save**.
## Setting the timestamp format
For profile panels, you can configure the timestamp format preference that will be applied to all timestamps for each IAM user or IAM role in Detective.
**Note**
The timestamp format preference is not applied across the entire AWS account.
Set the preference for timestamp.
1. Open the Amazon Detective console at [https://console.aws.amazon.com/detective/](https://console.aws.amazon.com/detective/).
1. In the Detective navigation pane, under **Settings**, choose **Preferences**.
1. On the **Preferences** page, under **Timestamp preferences**, view and change the preferred display for all timestamps.
1. By default, the timestamp format is set to UTC. Click **Edit** to choose your local timezone.
Example:
**Example**
UTC - 09/20/22 16:39 UTC
Local - 09/20/2022 9:39 (UTC-07:00)
1. Choose **Save**.