AlgoSec Reporting Tool

This topic describes how to use the AlgoSec Reporting Tool (ART). ART enables you to to create and view ASMS data about devices, change requests, and AppViz applications, in a variety of charts, tables, and advanced dashboards.

Enable AlgoSec Reporting Tool

If ART is not enabled yet, do the following:

1. Enable ART operations:

   To enable ART for your ASMS system, log in to ASMS via SSH as user root and run the following command:

   /usr/share/fa/bin/toggle_art.sh on

2. Synchronize AFA user permissions:

   ART is available only to users who are configured for access. Non-admin users who have access to ART will only see data relevant to their allowed firewalls.

   For more details, see Manage users and roles in AFA and Manage privileged users.

   Run the following to synchronize user permissions:

   curl -sS -x "" -# 127.0.0.1:8080/afa/UserAliases/allUsersAliases

   This resets the user permissions for the data in ART and creates the relevant users.

Access the AlgoSec Reporting Tool

The AlgoSec Reporting Tool is available from the main menu on the left in AFA or FireFlow, or from AppViz.

Once in ART, you can view the built-in dashboards or create your own graphs and dashboards.

• Discover data: Browse ASMS data to use in graphs and charts.
• Visualize data: Create or load graphs and charts and then add or modify graph content.
• Dashboards: Create or edit dashboards consisting of panels containing graphs or visualizations created in the Visualize area.

Discover data

In ART, on the Discover page, browse ASMS data to use in graphs and charts. ART enables you to create custom searches and filters.

Do the following:

1. Click the hamburger icon (☰) at the top left of the screen and click Discover.

2. Click the drop down to select the type of data you want to view.

   

   applications	View data by AppViz applications.
   change_requests	View data by FireFlow change requests.
   devices	View data by devices that are managed by AFA.

3. Filter the data. See below Add a filter.

4. Continue with creating graphs and dashboards. For details, see Visualize data straight from the Discover page, Visualize data, and Dashboards.

Visualize data

In ART, on the Visualize page you can create or load graphs and charts and then add or modify the content.

Export, share, or embed your visualizations in other locations like external iFrame or html, or add them to ART dashboards. For more details, see Dashboards.

Do the following:

1. In ART, click the hamburger icon (☰) in the upper left hand side of the screen and click Visualize.

   A list of saved visualizations is displayed.

2. Click the name of a saved visualization to view, or click Create new visualization to create a new visualization.

Create new visualization

If you selected to create a new visualization, do the following:

1. Select a chart type to use.

2. Select a saved search to use as the data set, or select an index to create a new visualization. For more details, see Discover data.

3. Once your chart is displayed, define the data metrics and other options for your chart. Click to apply your changes.

   Available options depend on the type of chart you're working with. For example:

   

4. Above the chart display, define a filter to further filter the data shown. See below Add a filter

5. Continue by creating dashboards that include your charts. For details, see Visualize data straight from the Discover page, Visualize data, and Dashboards.

Dashboards

ART dashboards consist of panels containing graphs or visualizations created in the Visualize area. In addition to the default dashboards that AFA provides out of the box, create or customize your own dashboards to suit your needs.

Do the following:

1. In ART, click the hamburger icon (☰) in the upper left hand side of the screen and click Dashboard. ART displays a list of saved dashboards.

   Search for the dashboard you want to view or edit, or click to create a new dashboard.

Create a new dashboard

If you are creating a new dashboard from scratch, add saved graphs and charts as panels to your dashboard.

1. Click either:

   • Create panel: The new visualization dialog appears. Choose items to create your visualization.

   • Add from library: Add saved graphs and charts from the library. Click a visualization name in the list to add as a new panel to the dashboard draft

2. Give the dashboard a name and click Save to save your new dashboard.

View or edit a dashboard

1. You can work with your dashboard in two modes:

   View mode	View dashboard panels.
   Edit mode	When you are creating a new dashboard, you work in edit mode until you save the dashboard. If you are editing a saved dashboard, click Edit at the top of the page to modify the panels or reposition them.

Working in View Mode

In View mode, each panel has the following controls that appear when you hover over them:

Click to see the ellipsis menu:

Options	Description
Explore underlying data	To gain insight to the data, open the underlying panel or data series documents in Discover. The panel documents that you open in Discover have the same time range and filters as the source panel.
Customize time range	Set a new time range for the visualization
Inspect	Inspect data and download as a csv file.
Maximize panel	See panel in full screen.

Click to toggle the legend in the panel display.

Working in Edit Mode

In the dashboard page click the Edit button in the upper right hand of the screen to enter Edit Mode.

Each panel has the following controls that appear when you hover over them:

Hover over the top bar of the panel to display the move arrows . You can move the panel to another location in the dashboard.

Click to adjust the size of the panel.

Click to toggle the legend in the panel display .

Click to display the options menu:

Options	Description
Edit visualization	Opens the editor so you can make changes to the panel.
Clone panel	Cloned panels appear next to the original panel, and move the other panels to provide a space on the dashboard.
Edit panel title	Edit the panel title.
...more	enables the following additional options: Customize time range Inspect Maximize panel Replace panel Delete from dashboard
Create drilldown	Drilldowns enable you to define new behaviors for interacting with panels. You can add multiple actions and override the default filter.

When you're done customizing your dashboard, click Save and enter a name and description for your dashboard.

Click Cancel at the top of the page to exit the editing mode and discard your changes.

Dashboard options

Use the following additional options at the top of the page to manage your dashboard:

Full screen	View mode only	Show dashboard in full screen.
Options	Edit mode only	Click to: Use margins between panels Show panel titles
Share	Both Edit and View modes	Display links to either share a saved dahsboard or a snapshot. Use the Embedded iframe URL to embed this chart in another location. Tip: Full link URLs may be long. Click Copy to copy the full URL to the clipboard, or Short URL to display a shorter URL that's easier to share.
Clone	View mode only	Make a copy of the dashboard currently displayed for editing.
Library	Edit mode only	Add panel from library
Cancel	Edit mode only	Close edit view
Save	Edit mode only	Save dashboad

Add a filter

Do the following:

1. Click + Add Filter. For example:

   

2. In the Edit filter dialog, enter a field name, operator, and value.
3. Click Save to add the selected values to the filter.

The field and value is added to the filter list above the data type dropdown and field lists.

For example:

At the top of the page, click any of the following to manage the filtered data:

New	Discard all of your changes and start a new filter from scratch.
Save	Save your filter so that you or other users can return to it later on.
Open	Click to view a list of saved searches.
Share	Display links to either share a saved search or a snapshot. Tip: Full link URLs may be long. Click Copy to copy the full URL to the clipboard, or Short URL to display a shorter URL that's easier to share.
Inspect	Provides information about the data and the Elasticsearch query used to retrieve it.
Date selector	Define the date range for the data displayed. For details, see Change date ranges.

Visualize data straight from the Discover page

Go to Visualize in order to create graphs based on a specific filter field.

Do the following:

Jump directly from the Discover page of ART to Visualize in order to create graphs based on a specific filter field.

1. In Discover page, hover over any filter name in the Selected or Available Fields list to display a bar chart of the values for that field.

   For example:

   

2. Click Visualize to display the selected field in the Visualize area.

For more details, see Visualize data.

Index fields by data type

Each data type provides a different set of fields for discovering and visualizing data in ART.

For details, see:

Change date ranges

Date range selectors enable you to filter according to a specific date range.

Do any of the following:

• Use the < > arrows to move back and forth between incremental date ranges.

• Click the selected date range, shown in the center of the < > arrows, to select a more complex date range.

  The Time Range area expands, providing you with a series of options of the following types:

  Now	Provides quick options, like Today, Previous month, Last 24 hours, or Last 2 years.
  Relative	Enables you to define date ranges from a specified time ago or from now, to another specified time ago or from now.
  Absolute	Enables you to select specific start and end dates.

Click Go to update the data displayed based on your date range selections.

For example:

Manage ART objects

The ART Management area enables you to manage saved queries, visualizations, and dashboards.

Do the following:

1. Click the hamburger icon (☰) at the top left of the screen and click Management.

2. Click Stack Management, and then click Saved objects in the left hand menu.

3. Click Type and select one of the following items:

   • Dashboards. Manage saved dashboards. For more details, see Dashboards.
   • Searches. Manage saved searches. For more details, see Discover data.
   • Visualizations. Manage saved graphs and charts. For more details, see Visualize data.

4. Do any of the following:

   Find your object	Browse the list or enter a name in the search field to locate your object.
   Edit object settings	Click an object name in the list to make changes, such as to the object title. This option also enables you manage advanced settings, such as supporting JSON code. We recommend making advanced changes like these only if you are an advanced Kibana user.
   Open object in ART	Hover over the object name, and click the eye icon to open it Discover, Visualize, or Dashboard areas.
   Delete objects	Select one or more objects in the list, and click Delete to delete the selected items. In the warning dialog that appears, click Delete ... to confirm the deletion.
   Export objects	Select one or more objects in the list and click Export to save the relevant JSON data locally. To export JSON data for all objects, click Export Everything at the top of the page.
   Import	Create ART objects by importing a JSON file. At the top of the page, click Import and select a JSON file to import.

Troubleshoot ART

If you run into issues when using the AlgoSec Reporting tool, you may want to check the relevant log files.

ART-related logs are created for the Elastic, Kibana, and Logstash services in the /var/log directory on the AFA machine.