Drill-down means moving from a general value to more detailed data within the same hierarchy. You click an element of a report, chart, or dashboard — for example a regional total, an alert, or a traffic metric — and step one level down to see what that value is made of. Drill-down is the inverse of roll-up (aggregating upward) and one of the classic OLAP operations.
How does drill-down work?
Drill-down navigates a dimension hierarchy — levels ordered from general to detailed. Typical hierarchies include time (year → quarter → month → day), geography (country → region → city), and company structure (department → team → employee). Each step down keeps the context of the level above and shows only the records that fall within the value you picked.
- Starting point — an aggregated view, e.g. a monthly event count or overall traffic volume.
- Pick an element — click the bar, row, map segment, or cell that stands out.
- Step down a level — the system narrows the data to the chosen value and shows the next, finer level of the hierarchy.
- Return (drill-up / roll-up) — aggregate back to the broader view.
How does drill-down differ from drill-through and roll-up?
- Drill-down — stepping lower within the same hierarchy and the same dataset (region → city).
- Roll-up (drill-up) — the inverse: aggregating upward, from detail to summary.
- Drill-through — moving from an aggregated value to a different, usually more detailed source or report (for example from a metric to the underlying transactional records or raw logs), often outside the current view.
Drill-down in network monitoring and security
In NDR, SIEM, and network traffic analysis (NTA) tools, drill-down is the core way analysts work during incident response and threat hunting. A SOC analyst steps down through levels of telemetry, getting closer to the raw data:
- Alert / anomaly — the starting point: a suspicious event or a deviation from the baseline.
- Flows — NetFlow/IPFIX/sFlow records showing who talked to whom, on which ports, at what volume and time.
- Session / conversation — a single connection between two hosts, with application-layer metadata.
- Packet (full packet capture, PCAP) — the lowest level: the complete contents of the communication for forensic analysis.
This path — from a broad alert, through flows, down to a single packet — lets an analyst confirm or reject a hypothesis (is the alert a real problem, a true positive), establish scope (which hosts, for how long), and collect evidence. Effective security drill-down depends on whether the historical data is there at all: if packets or flows were not retained, there is no way to step down to detail and the investigation stalls at the metadata level. That is why both how long the data is kept and who can access the lowest levels matter here — packet contents may include sensitive data.
Learn more
- How do you drill down data? — a hands-on, step-by-step guide
- Enhancing Network Visibility: Zabbix Integration with Sycope Made Easy — Shows how drill-down can move from alerts to detailed Zabbix-linked network data.
- Incident Response Lifecycle — Drill-down helps investigators move from an incident alert to the underlying events.
- UEBA (User and Entity Behavior Analytics) — UEBA uses drill-down to inspect behavior details behind suspicious user or entity activity.
- Data mining — Drill-down is a common way to explore data at deeper levels during data mining.
- XDR — XDR correlates signals, and drill-down reveals the events behind a detection.
- MITTRE ATT&CK — Drill-down helps map an alert to the ATT&CK technique and its supporting evidence.
- Inventory — Drill-down can expose inventory details for a selected asset or device.
