WEBVTT 1 00:00:00.634 --> 00:00:17.994 Welcome to NxSAM training. This module covers the Analytics Dashboard: the cross-module view of your security posture. Where each security module shows you its own findings, this shows everything at once, and lets you slice it. 2 00:00:18.265 --> 00:00:39.517 There are two halves. The Dashboard is charts and figures, built for understanding the shape of your posture. Live Data is the records behind them as a table, built for working with specifics. They share the same filters, so a shape you notice in a chart can be taken straight through to the rows behind it. 3 00:00:40.082 --> 00:00:50.796 This is the dashboard as it ships. We will read it first, then filter it, then rearrange it, then build a chart the product does not supply. 4 00:00:51.383 --> 00:01:05.796 Top left is the profile selector. A profile is the whole dashboard as you arranged it, and we will come back to it at the end. For now, note that you are always looking at the dashboard through one. 5 00:01:06.395 --> 00:01:18.763 The top row carries the headline figures. Total assets, overall compliance, open vulnerabilities, and critical open. These are the numbers to quote. 6 00:01:19.362 --> 00:01:27.991 Each card carries its own trend line, so a figure that looks healthy but has been climbing for a fortnight does not read as healthy. 7 00:01:28.265 --> 00:01:37.541 Below the headline figures, every widget breaks that same population down by a different dimension, and each answers a different question. 8 00:01:38.123 --> 00:01:56.997 Severity breakdowns answer how bad is what we have. Age and S L A widgets answer how long we have had it and whether we are late. Trend widgets answer whether we are getting better or worse. And top-N widgets answer where attention should go first. 9 00:01:57.579 --> 00:02:08.896 Every widget has its own header and its own controls in that header. The funnel filters this widget alone, independently of the dashboard's global filters. 10 00:02:09.493 --> 00:02:25.463 That independence is the single commonest reason two colleagues comparing the same widget see different numbers. A per-widget filter does not appear anywhere in the global filter bar, so there is nothing at the top of the screen to tell you it is on. 11 00:02:26.046 --> 00:02:44.106 One more thing worth knowing before you go hunting for a bug. A dashboard figure and a module count can differ legitimately, because the dashboard applies its own filters and counting rules. Check the filter bar before treating a discrepancy as an error. 12 00:02:44.718 --> 00:02:47.103 Which brings us to filtering. 13 00:02:47.687 --> 00:02:59.179 Filters sit along the top and apply to everything below. They combine, so narrowing by module and severity together shows only the findings matching both. 14 00:02:59.764 --> 00:03:11.849 Customize opens the picker. Which filters you can choose from is itself configurable, so the bar shows the ones your team actually uses rather than all of them at once. 15 00:03:12.126 --> 00:03:31.308 Filters can also be pinned, which keeps them applied. That is convenient, and it is also the most common cause of the numbers looking wrong. A pinned filter persists and is very easy to forget about. If a figure looks unexpectedly small, check here first. 16 00:03:31.919 --> 00:03:44.335 Now the part people are most often surprised to learn exists. You can rearrange this dashboard, hide what you do not use, and build charts the product does not supply. 17 00:03:44.930 --> 00:03:56.247 Edit dashboard layout puts the grid into edit mode. Outside edit mode the widgets are deliberately locked, so you cannot nudge one out of place while reading. 18 00:03:56.849 --> 00:04:13.610 The toolbar across the top tells you the two gestures. You move a widget by dragging its header, and you resize it from any edge or corner. Dragging the chart itself does nothing, because that is reserved for interacting with the chart. 19 00:04:13.880 --> 00:04:29.230 Drag two widgets onto each other and they swap places rather than pushing everything below them down the page. The grid is twenty-four columns wide with a fixed row height, so a half-width widget is exactly half-width on every screen. 20 00:04:29.833 --> 00:04:35.244 Six buttons sit on that toolbar. We will take them in order. 21 00:04:35.845 --> 00:04:42.839 Add chart opens the custom chart builder, which is the next chapter and the largest part of this module. 22 00:04:43.429 --> 00:04:54.358 Widgets opens the full list with a switch against each one. Hiding what your team never looks at is what makes a dashboard useful rather than merely complete. 23 00:04:54.948 --> 00:04:57.498 Let us actually open it. 24 00:04:58.082 --> 00:05:10.383 Every widget on the dashboard, with a switch each. Turn one off and it leaves the grid; turn it back on and it returns to where it was. Nothing here is destructive. 25 00:05:10.998 --> 00:05:14.487 We will close this without changing anything. 26 00:05:15.084 --> 00:05:25.990 Compact pulls every widget upward to close the empty rows that hiding or resizing leaves behind. It is the tidy-up you want after a session of rearranging. 27 00:05:26.598 --> 00:05:32.194 Reset to defaults returns the factory arrangement, discarding your changes. 28 00:05:32.789 --> 00:05:48.114 Discard leaves edit mode and restores what was there when you entered it. And Save and Exit keeps the arrangement. Nothing at all is saved until you press Save and Exit, so experimenting in here is completely safe. 29 00:05:48.696 --> 00:05:59.476 Now the custom chart builder. This is the part of the product that most changes what a dashboard can tell you, and it is worth going through field by field. 30 00:06:00.062 --> 00:06:05.472 We will build a real one: open issues by severity, as a donut. 31 00:06:06.058 --> 00:06:16.988 The builder has the form on the left and a live preview on the right. The preview redraws as you change the form, so you are never guessing what you are about to save. 32 00:06:17.578 --> 00:06:27.569 Title first. This becomes the widget's heading on the dashboard, so name it for the question it answers rather than for the fields it uses. 33 00:06:28.183 --> 00:06:30.907 Open issues by severity. 34 00:06:31.481 --> 00:06:42.582 Chart type comes next, and there are eleven of them. What matters is not the list but the rule behind it: each type accepts a fixed number of groupings. 35 00:06:43.174 --> 00:07:00.505 K P I is a single value and takes no grouping at all. Bar, pie and donut take exactly one. Stacked bar, grouped bar, matrix and heatmap take exactly two, because they all show one dimension crossed with another. 36 00:07:01.090 --> 00:07:12.142 Line and area take one or two, and they are the only types that accept a time grouping. Table takes up to two, and returns far more rows than a chart. 37 00:07:12.732 --> 00:07:14.708 We want a donut. 38 00:07:15.299 --> 00:07:30.478 Data decides which population you are charting: open issues, or closed issues from Network V A and Policy Compliance. This choice matters more than it looks, because it changes which metrics are available. 39 00:07:31.063 --> 00:07:39.761 Metric is what the chart measures. There are ten, and each is valid on open data, closed data, or both. 40 00:07:40.382 --> 00:07:58.323 Issue count is the default. Affected assets counts assets rather than findings, so a host with nine findings counts once. Average and total vulnerability score are the weighted views, for when a plain count treats a critical and an informational alike. 41 00:07:58.951 --> 00:08:18.403 Then four S L A metrics: overdue count, overdue percent, no-S L A count and within-S L A count. All four are open-only, and the reason is worth understanding. A closed finding has no S L A state left to be in, so the question does not apply. 42 00:08:18.687 --> 00:08:39.291 The mirror image is M T T R, mean time to remediate, which is closed-only, because an open finding has not been remediated yet. It can be grouped by severity or module and cannot be shown over time. And Policy Compliance percent is available on the K P I type alone. 43 00:08:39.910 --> 00:08:42.271 We will take issue count. 44 00:08:42.856 --> 00:08:51.005 Group by is the dimension the chart splits on. The list is in two parts, and the split is the important bit. 45 00:08:51.619 --> 00:09:05.771 Standard holds the product's own fields: module, network type, status, severity, audit type, tool, policy, C V E, your three tenant levels, bifurcation type and asset type. 46 00:09:06.393 --> 00:09:19.267 Below them sit your asset properties, which are whatever your organisation has chosen to record about an asset. That second group is why two deployments do not offer the same dimensions. 47 00:09:19.877 --> 00:09:22.549 Severity, for this chart. 48 00:09:23.122 --> 00:09:32.420 And there it is. The preview drew as soon as the specification was complete enough to run, sorted highest value first. 49 00:09:33.039 --> 00:09:45.770 Below the grouping sits data scope: filter by module, by severity, and by status. These narrow the population the chart is built from, before any grouping happens. 50 00:09:46.360 --> 00:10:05.432 Customize widget filters is a different thing, and the difference catches people out. It decides which filters appear on the finished widget's own funnel, for whoever is reading it later. Data scope narrows the chart now; widget filters give the reader controls afterwards. 51 00:10:06.019 --> 00:10:16.426 Sort and limit control the order of the groups and how many to keep. A top ten is simply a limit of ten with the sort set to value, high to low. 52 00:10:17.005 --> 00:10:22.413 Show legend and show value labels put the numbers on the marks themselves. 53 00:10:23.014 --> 00:10:50.094 And the style options underneath change with the chart type, which is worth watching for rather than hunting through. A donut offers a donut hole size. A stacked bar offers stacked or one-hundred-percent stacked. Bars offer orientation, and horizontal reads better with long labels. Pie and donut offer label format and placement. All of them offer a colour palette. 54 00:10:50.708 --> 00:10:58.520 Save chart stays disabled until the specification is valid, so a chart that could not run cannot be saved. 55 00:10:59.140 --> 00:11:00.948 Let us save it. 56 00:11:01.525 --> 00:11:16.130 A saved chart is added at the end of the dashboard, so we scroll down to it. And there it is, alongside the supplied widgets, drawn from the same data and able to be moved and resized exactly like them. 57 00:11:16.741 --> 00:11:30.266 Each custom chart card carries three actions of its own. Edit reopens this builder. Delete removes the chart. And Refresh re-runs that one chart's query alone. 58 00:11:30.861 --> 00:11:45.895 Refresh is the useful diagnostic. If a single chart looks stale while the rest of the dashboard is current, refreshing it separates a problem with that chart's own query from a problem with the warehouse sync feeding everything. 59 00:11:46.487 --> 00:11:52.330 We will keep this arrangement, which means leaving edit mode through Save and Exit. 60 00:11:52.957 --> 00:12:01.321 Everything we have just done - the layout, the hidden widgets, the custom chart, the filters - lives in a profile. 61 00:12:01.950 --> 00:12:08.250 The profile menu opens from the profile name at the top left, and holds three items. 62 00:12:08.872 --> 00:12:21.656 Save as new profile creates a named profile from what is on screen right now: the filter pins, their values, and the widget layout. Your other profiles are not affected. 63 00:12:22.270 --> 00:12:35.002 Manage profiles lets you rename one, set one as your default, or delete it. And Share current profile makes it available to other people, but only on a profile you own. 64 00:12:35.273 --> 00:12:53.354 Sharing offers three levels. Private, which is only you and is the default. Specific people, chosen by name, where you can also see who currently has access. And anyone in the organisation, which means everyone who can sign in. 65 00:12:53.959 --> 00:13:14.755 Ownership is worth being clear about, because it explains a question people often ask. Edit dashboard layout is only offered on a profile you own. A profile shared with you is read-only, so to rearrange it you save your own copy first, and then you own the copy and can edit it freely. 66 00:13:15.351 --> 00:13:28.849 And because layouts are personal, two people comparing the dashboard may genuinely be looking at different arrangements of the same data, or at different profiles altogether. That is not a fault. 67 00:13:29.448 --> 00:13:34.761 The other half of the module is Live Data: the records behind the charts. 68 00:13:35.389 --> 00:13:45.095 This is where to go when you need to know which findings rather than how many. One line per finding, across every module at once. 69 00:13:45.714 --> 00:14:06.915 The subtitle under the title is worth a glance every time. It reports how many rows matched and how long the query took. A row count that did not change after you applied a filter usually means the filter matched everything, and a query time climbing into seconds is the signal to narrow the range before exporting. 70 00:14:07.498 --> 00:14:19.292 Open, Closed and All is the first decision and the widest one. Open is the default, and this is a genuine change of population rather than a filter on top of one. 71 00:14:19.897 --> 00:14:33.204 That distinction matters for one specific reason. Closed findings have no S L A state at all, so the S L A column and the overdue colouring are only meaningful while you are looking at Open. 72 00:14:33.824 --> 00:14:40.712 Columns opens a two-panel picker, and it is the control that makes this screen yours rather than ours. 73 00:14:41.283 --> 00:14:58.237 The left panel is what you have selected, in the order they will appear, numbered by position. The right is everything available. Reorder with the arrows beside each selected column, remove with the cross, and add by clicking a chip on the right. 74 00:14:58.808 --> 00:15:21.977 What you can add is grouped into two. Standard is the product's own catalog: identity fields like vulnerability I D, plugin I D and C V E; where it lives, such as client, project, asset type, port and protocol; where it came from, such as module, tool and audit; risk and rating; and lifecycle dates. 75 00:15:22.571 --> 00:15:40.893 Asset properties is the group worth knowing about. Any property your organisation has defined - data classification, hosting region, business criticality, owning team - becomes a column here under its own name, with no development work and no request to us. 76 00:15:41.510 --> 00:15:57.740 Reset to default returns the standard eight: severity, finding, asset, source, status, age, S L A due and risk score. That is why those eight are not in the list of things you can add - they are already there. 77 00:15:58.021 --> 00:16:23.325 One caveat on sorting. A sortable heading carries a sort control and the rest are display-only, because sorting them would mean ordering the whole result set rather than the page in front of you. Sort is offered on severity, finding title, age, S L A due, discovery date, legacy risk score, client, project, tool and vulnerability I D. 78 00:16:23.935 --> 00:16:27.424 We will close this without changing anything. 79 00:16:28.018 --> 00:16:42.623 Filtering here happens through four different mechanisms, and they stack. Knowing which is which saves a great deal of confusion about why a list is not what you expected - because they do not all live the same length of time. 80 00:16:43.202 --> 00:16:55.140 The search box is one field across asset, host or I P, project, client, C V E, plugin and finding title. It lasts until you clear it. 81 00:16:55.414 --> 00:17:17.143 The chips above it are pinned quick filters, and those are saved on your profile. Two kinds sit there and they behave differently. A property pin opens a value list when clicked, where you pick values, choose Include or Exclude, and apply. A value pin is a single click that applies one exact condition. 82 00:17:17.418 --> 00:17:27.007 Every value list shows how many findings carry each value beside it, so you can see whether a filter is worth applying before you apply it. 83 00:17:27.281 --> 00:17:40.970 Include and Exclude are available everywhere, and Exclude is the one people miss. It is usually the shorter route: everything except Informational is one condition, where the include form is four. 84 00:17:41.569 --> 00:17:53.774 Add filter builds ad-hoc conditions for something you need once. Each row is a field, an Include or Exclude choice, and either values ticked from a list or text to match. 85 00:17:54.394 --> 00:18:12.477 The field's own type decides which of those you get. Enumerable fields - severity, module, status, owner - give a searchable checkbox list with counts. Free-text fields give a contains box, where a comma separates several alternatives. 86 00:18:13.043 --> 00:18:23.013 These are deliberately not saved, and the dialog says so. If a condition proves useful enough to want again, pin it on the rail instead. 87 00:18:23.619 --> 00:18:40.814 Date filters give two ranges, each with a from and a to: Discovered, for when the finding first arrived, and S L A Due. They answer different questions - what appeared last quarter, versus what falls due next month - and they combine freely. 88 00:18:41.402 --> 00:19:03.418 And Filter context is the quiet one that solves a real problem. It adds a second line under each row listing the fields you filtered on, with this row's values. Use it when you filtered on something that is not one of your columns - asset owner, say - and want to see the matched value per row without adding a column for it. 89 00:19:04.013 --> 00:19:08.439 Now the part that ties the two halves of this module together. 90 00:19:09.000 --> 00:19:28.905 Clicking a bar or a slice on the dashboard brings you here with that slice already applied, and it arrives as chips above the table: severity critical, module V A. Each chip has its own cross, and Clear all removes the set - which is how you widen from one bar to its whole chart without going back. 91 00:19:29.482 --> 00:19:47.227 Clicking any row opens the detail drawer: the whole finding grouped into classification, source and audit, location, lifecycle, risk and asset properties. At the top of it sits a matched-filters section showing exactly why this row is in your list. 92 00:19:47.823 --> 00:20:04.800 And the back control at the top left returns you to the dashboard. That round trip is the point of the module: notice a shape in a chart, land on the rows that produced it, and go back - with the filters carried both ways rather than rebuilt each time. 93 00:20:05.401 --> 00:20:24.224 Profiles work here too, and carry a little more than on the dashboard: your pinned filters, their default values, your column choices, and your export configuration. Load Org Default returns to the organisation's standard arrangement, discarding this session's tweaks. 94 00:20:24.811 --> 00:20:46.109 Ad-hoc changes are not saved automatically, and the switcher tells you so. Column choices are the one exception, and only when you ask: both pickers offer Save as the default for this profile, which is offered only on a profile you own. A profile shared with you stays as its author arranged it. 95 00:20:46.694 --> 00:20:59.785 Export is configured separately from what is on screen, and that is deliberate. The columns that make a readable screen and the columns that make a useful spreadsheet are rarely the same set. 96 00:21:00.386 --> 00:21:18.178 The export picker works identically - select, order, reset - with one addition worth the whole feature. Each column has a free-text heading, and whatever you type becomes the heading in the file. Leave it blank to use the product's own label. 97 00:21:18.778 --> 00:21:31.149 That is how an export lands in a colleague's inbox already using their vocabulary rather than ours, which is usually the difference between a spreadsheet someone uses and one they ask you to redo. 98 00:21:31.756 --> 00:21:38.777 Export C S V then runs against your current filters, your status choice and your export columns. 99 00:21:39.382 --> 00:21:55.907 Two expectations to set about it. It does not hold the page: it is queued, and the Export panel beside the button reports its state - running, completed with a file size, or failed with the reason. You download it from there. 100 00:21:56.175 --> 00:22:08.708 And only one runs at a time. While one is going the button is disabled, because a second export of a large result set would compete with the first for exactly the same resources. 101 00:22:09.306 --> 00:22:21.773 One last thing, in case you ever meet it. This screen reads from the analytics warehouse rather than the operational database, which is what lets it page through millions of findings. 102 00:22:22.742 --> 00:22:41.021 So there are two messages that mean it is not there. Not connected means no connection is configured, and an administrator needs to set one up. Unreachable means it is configured but did not answer, which is an infrastructure matter rather than a settings one. 103 00:22:41.304 --> 00:22:54.420 In both cases the rest of the platform is unaffected, because every module screen reads the operational database directly. It is only this analytics view that waits on the warehouse. 104 00:22:55.027 --> 00:23:18.562 Two last things that explain most of the questions this dashboard generates. Figures can move without anyone changing anything, because S L A states change as dates pass and ageing moves findings between bands. Something within S L A yesterday can be overdue today with no edit at all. That is the calendar, not the data. 105 00:23:19.172 --> 00:23:31.929 And when a number looks wrong, check the filters first: the global bar, then any pinned filter, then the widget's own funnel. That order finds the explanation almost every time. 106 00:23:32.537 --> 00:23:46.996 That is the Analytics Dashboard. You can read it, filter it, rearrange it, build charts the product does not supply, and share the result as a profile. The next module covers Assets.