Custom dashboards and charts

You can create custom dashboards in AFA that include built-in charts, custom charts, or both, by defining them directly in XML.

Note: For more details, see AlgoSec Reporting Tool.

Configure custom charts

When creating a dashboard with custom charts, you must configure the custom charts before you configure the dashboard itself.

You specify the title of the chart.
You specify the type of chart.
You specify the variable for which the chart displays data.
You specify the Y-axis values the chart displays.
For bar charts, you also specify the following:
- The number of devices displayed in the chart.
- Whether the chart starts with displaying the devices with the most of the variable or the least of the variable.
- The direction of the chart.
For trend charts, you also specify how many days back the chart displays.

Add a custom chart

Open a terminal and log in using the username "afa" and the related password.
Create a new file in /home/afa/.fa/charts.
Name the file chart_name.xml, where chart_name is the name you choose for the chart.

Add the CHART tag to the file, using the information in Chart tag reference. For an example, see Chart Example.
Save the file.

Chart tag reference

This reference describes the use of the chart tag and its sub-tags.

Tag syntax is presented as follows:

All parameters and content are presented in italics.
All optional elements of the tag appear in square brackets [ ].

Note: All tags, parameters, and content are case sensitive, and must be in lower case.

title

variable_name

color	String. The color of the bar or series of the variable, expressed in #RGB. This parameter is for count type and trend_count_group type charts, and the default chart type only. This parameter is optional.
value_condition	String. A condition, such that, only devices with a variable value that passes the condition will be counted. This parameter is for count type and trend_count_group type charts only. For trend_count_group type charts, only equality is supported, and the value is stated without the operator. Note: For trend_count_group type charts, this variable is an integer. This parameter is optional.
bar_name	String. The label of the bar. This parameter is for count type charts only. This parameter is optional.
function	String. An aggregate function used to compile the chart data. All aggregate SQL functions are supported (for example: "avg", "min",and "max"). This parameter is for trend_value type charts only. This parameter is optional. The default function is the average function, which compiles the average of the data over the group.
legend	String. The label of the variable in the legend. This parameter is for trend_value type charts only. This parameter is optional.
sum	String. The sum of the statistic type. This parameter is for sum_over_time and trend_sum_over_time type charts only. This parameter is optional.

Variable Content Options	Available Statistic Type.	Specifies this...
rules	simple_count	The number of rules for each device.
covered_rules	simple_count	The number of covered rules for each device.
special_case_rules	simple_count	The number of special case rules for each device.
unused_rules	simple_count	The number of unused rules for each device.
security_rating	simple_count	The security rating for each device.
highest	risk_level	The highest risk level of each device.
PCI	compliance_pass	Whether a device meets PCI compliance.
high	risks_per_risk_level	The number of high risks for each device.
suspected_high	risks_per_risk_level	The number of suspected high risks for each device.
medium	risks_per_risk_level	The number of medium risks for each device.
low	risks_per_risk_level	The number of low risks for each device.

statistics_type

Content Options	Specifies this...
simple_count	The count of the variable for each device. This statistic type is available for the following variables: rules, covered_rules, special_case_rules, unused_rules, and security_rating. For example, if the statistic type is simple_count, and the variable is rules, the chart will display the number of rules for each device. Note: When the simple_count statistic type is used with the security_rating variable, the security rating for each device is displayed.
risk_level	The risk level of each device. This statistic type is available for the highest variable. When this statistic type/variable combination is used, the chart will display the number of devices whose highest risk is high, suspected high, medium, and low.
compliance_score	The compliance score of each device. This statistics type is available for the following variables: HIPAA, BASEL, NIST_800-41, NIST_800-53, ISO27001, NERC4, GLBA, TRM, DSD, SOX, PCI.
compliance_color	The compliance color of each device. This statistics type is available for the following variables: HIPAA, BASEL, NIST_800-41, NIST_800-53, ISO27001, NERC4, GLBA, TRM, DSD, SOX, PCI.
baseline_score	The baseline compliance score of each device (the score is the percentage of met requirements).This statistics type is available for the baseline variable.
risks_per_risk_level	The number of risks for a specific risk level for each device. This statistic type is available for the following variables: high, suspected_high, medium, and low. For example, if the statistic type is risks_per_risk_level, and the variable is high, the chart will display the number of high risk rules for each device.
total_changes	The number of changes on each device. This statistic type is available for the sum variable. When this statistic type/variable combination is used, the chart will display the total number of changes on each device.

type

Content Options	Specifies this...
count	A bar chart that specifies the count of devices for each variable.
condition	A bar chart that displays the number of devices whose variable value is greater than the Chart_Threshold_Val configuration item, and the number of devices whose variable value is not, for all devices in the group. For details, see the Chart_Threshold_Val parameter.
trend_value	A trend chart that displays a calculation (defined by the function parameter of variable_name) of the variable values over all devices in the group, over time.
trend_condition	A trend chart that displays the number of devices whose variable value is greater than the Chart_Threshold_Val configuration item, and the number of devices whose variable value is not, for all devices in the group, over time. For details, see the Chart_Threshold_Val parameter.
trend_count_group	A trend chart that displays the total count of the variable for all devices in the group, over time.
sum_over_time	A bar chart that displays the accumulation of the statistic for each device in the group.
trend_sum_over_time	A trend chart that displays the accumulation of the statistic, over time.
empty (default)	A bar chart that displays the count of the variable for each device in the group. There can be multiple variables per device.

order_dir

Content Options	Specifies this...
ASC	The bar chart will start with displaying devices with the least of the variable. For example, if the LIMIT tag is set to 6, this will produce a chart with the bottom 6 devices.
DESC	The bar chart will start with displaying devices with the most of the variable. For example, if the LIMIT tag is set to 6, this will produce a chart with the top 6 devices.
empty	The ORDER_DIR tag defaults to DESC.

direction

Content Options	Specifies this...
horizontal	The bar chart will display horizontally.
vertical	The bar chart will display vertically.
empty	The DIRECTION tag defaults to vertical.

Chart Example

Configure a custom dashboard

Configure a custom dashboard by specifying the charts that the dashboard includes, the relevant device group, and the number of charts that appear in a row.

Do the following:

Open a terminal and log in as user afa.
Create a new file in /home/afa/.fa/dashboards.
Name the file <dashboard_name>.xml, where <dashboard_name> is the name you choose for the dashboard.
Add the DASHBOARD tag to the file, with the additional CHARTS and CHART sub-tags.

For more details, see Dashboard tag reference and Dashboard configuration example.

Dashboard tag reference

The following table describes the DASHBOARD tag and its subtags.

Tag name	Description
DASHBOARD	Identifies the dashboard and specifies how charts are oriented. Includes the CHARTS sub-tag. Parameters include: name. String. The dashboard name. This name appears at the top of the dashboard. columns. The number of charts that appear in each row of the dashboard. The charts will be filled in order of appearance, from left to right and top to bottom.
CHARTS	Defines all the charts that appear in the dashboard. Includes several CHART sub-tags.
CHART	Defines the type of data in the chart, and which device group's data appears in the chart. Parameters include: group. String. The name of the AFA device group that is analyzed in the chart. definition_file. String. The name of the chart XML file. Specify a custom chart that you created and saved in the <AFA home dir>/.fa/dashboards/charts directory, or a built-in chart.

Tag name

Description

DASHBOARD

Identifies the dashboard and specifies how charts are oriented. Includes the CHARTS sub-tag.

Parameters include:

name. String. The dashboard name. This name appears at the top of the dashboard.
columns. The number of charts that appear in each row of the dashboard.

The charts will be filled in order of appearance, from left to right and top to bottom.

CHARTS

Defines all the charts that appear in the dashboard.

Includes several CHART sub-tags.

CHART

Defines the type of data in the chart, and which device group's data appears in the chart.

Parameters include:

group. String. The name of the AFA device group that is analyzed in the chart.
definition_file. String. The name of the chart XML file.

Specify a custom chart that you created and saved in the <AFA home dir>/.fa/dashboards/charts directory, or a built-in chart.

Dashboard configuration example

The following code shows an AFA dashboard configuration file, including a DASHBOARD tag and CHARTS and CHART sub-tags.

        <DASHBOARD columns="2" name="Summary">
 <CHARTS> 
  <CHART definition_file="total_risks_per_type_per_fw.xml" group="ALL_FIREWALLS"/>
  
        <CHART definition_file="security_rating_trend.xml" group="ALL_FIREWALLS"/>
  
        <CHART definition_file="rules_per_fw.xml" group="ALL_FIREWALLS"/>
  
        <CHART definition_file="covered_rules_per_fw.xml" group="ALL_FIREWALLS"/>
 
        </CHARTS>
        
</DASHBOARD>