1. Issues Widget
1.1. Purpose
The purpose of this widget is to track objects having an issue modelled with an investigation. The objects returned by the investigation have to be the ones experiencing the issue (e.g., "sources with no antivirus"). Consequently, if the investigation returns no result, it means that there is no issue. In one single widget, one is able to define several issues. The issues are computed over a sliding period of time that can be of any length independently of what is available in the Engine. For exemple, one can define issues with a period of 60 days; it means that every day, the issues will be computed for the last 60 days. Issues can also be grouped by any category (e.g., per location).
1.2. Creating widget
1.2.1. Step 1
- enter the time period (in days)
- define the issues you'd like to track
- paste one investigation per issue or paste one folder (one issue per investigation contained in the folder will be created automatically)
- choose the computation mode. Two modes are available:
current status: only the current status of each object is taken into account. For instance, if one defines the issue "sources without antivirus", one usually wants to take into account if it has an antivirus right now. Otherwise, if on day D a source doesn't have an antivirus and on day D+1 one installs an antivirus on it, it would still appear as a source with the issue.
- all statuses: all statuses of each object during the time period is taken into account. For instance, if one defines the issue "sources with incident XYZ", one usually wants to take into account sources that have had the incident at least once during the whole period. Otherwise, one would only count sources that have had it during the last day only (assuming the source wass active on that day)
- the table summarize all issues to track and they could be edited and ordered. The order in the table defines the order the issues will be displayed
- select the number of days to display in trend chart
- select the Engines on which you want to track the issues
1.2.2. Step 2
- optionally select a criterion for grouping results ("group by"); it can be any category on any object type
1.2.3. Step 3
- optionally for each issue configure a reference widget to display values in percentage. The reference is an inventory on the same object with the same time period and same "group by" option.
1.3. Using widget
- Each issue is displayed in a list in configured order. For each issue, the number of objects experiencing the issue is displayed and a sparkline shows the trend over the past days. A green/red bullet is also displayed to show at a glance if there are any issue.
- If a "group by" category has been defined, each issue can be expanded to see the values per group (e.g., per location). One can also select one particular group (at the bottom of the widget) and then only the values for that group is displayed for all issues.
- The list of returned object can be displayed by clicking on the number. This list could be exported in csv format.
1.3.1. Ratio
One can choose two different modes to display values:
- none: display the values
- ratio: display the values in percentage of the referenced widget
When ratio is selected, if an issue has no reference configured then the absolute value is displayed