AlgoSec Reporting Tool

This topic describes how to use the AlgoSec Reporting Tool (ART). ART enables you to to create and view ASMS data about devices, change requests, and AppViz applications, in a variety of charts, tables, and advanced dashboards.

Note: The AlgoSec Reporting Tool is available in AppViz On-Prem.

Note: ART is powered by Kibana version 7.11.2. For more details, see the Kibana resources and documentation.

Enable AlgoSec Reporting Tool

If ART is not enabled yet, do the following:

  1. Enable ART operations:

    To enable ART for your ASMS system, log in to ASMS via SSH as user root and run the following command:

    /usr/share/fa/bin/toggle_art.sh on

  2. Synchronize AFA user permissions:

    ART is available only to users who are configured for access. Non-admin users who have access to ART will only see data relevant to their allowed firewalls.

    For more details, see Manage users and roles in AFA and Manage privileged users.

    Run the following to synchronize user permissions:

    curl -sS -x "" -# 127.0.0.1:8080/afa/UserAliases/allUsersAliases

    This resets the user permissions for the data in ART and creates the relevant users.

Access the AlgoSec Reporting Tool

The AlgoSec Reporting Tool is available from the main menu on the left in AFA or FireFlow, or from AppViz.

Once in ART, you can view the built-in dashboards or create your own graphs and dashboards.

  • Discover data: Browse ASMS data to use in graphs and charts.
  • Visualize data: Create or load graphs and charts and then add or modify graph content.
  • Dashboards: Create or edit dashboards consisting of panels containing graphs or visualizations created in the Visualize area.

Discover data

In ART, on the Discover page, browse ASMS data to use in graphs and charts. ART enables you to create custom searches and filters.

Do the following:

  1. Click the hamburger icon (☰) at the top left of the screen and click Discover.

  2. Click the drop down to select the type of data you want to view.

    applications View data by AppViz applications.
    change_requests View data by FireFlow change requests.
    devices View data by devices that are managed by AFA.
  3. Filter the data. See below Add a filter.

  1. Continue with creating graphs and dashboards. For details, see Visualize data straight from the Discover page, Visualize data, and Dashboards.

Visualize data

In ART, on the Visualize page you can create or load graphs and charts and then add or modify the content.

Export, share, or embed your visualizations in other locations like external iFrame or html, or add them to ART dashboards. For more details, see Dashboards.

Tip: Alternately, start by browsing data and then use that data to create graphs. For details, see above Discover data.

Do the following:

  1. In ART, click the hamburger icon (☰) in the upper left hand side of the screen and click Visualize.

    A list of saved visualizations is displayed.

  1. Click the name of a saved visualization to view, or click Create new visualization to create a new visualization.

Create new visualization

If you selected to create a new visualization, do the following:

  1. Select a chart type to use.

  2. Select a saved search to use as the data set, or select an index to create a new visualization. For more details, see Discover data.

  1. Once your chart is displayed, define the data metrics and other options for your chart. Click to apply your changes.

    Available options depend on the type of chart you're working with. For example:

  2. Above the chart display, define a filter to further filter the data shown. See below Add a filter

  1. Continue by creating dashboards that include your charts. For details, see Visualize data straight from the Discover page, Visualize data, and Dashboards.

Tip: Alternately, in the Discover page, select a field in the Available Fields list, and click Visualize . For more details, see Visualize data straight from the Discover page.

Dashboards

ART dashboards consist of panels containing graphs or visualizations created in the Visualize area. In addition to the default dashboards that AFA provides out of the box, create or customize your own dashboards to suit your needs.

Do the following:

  1. In ART, click the hamburger icon (☰) in the upper left hand side of the screen and click Dashboard. ART displays a list of saved dashboards.

    Search for the dashboard you want to view or edit, or click to create a new dashboard.

Create a new dashboard

If you are creating a new dashboard from scratch, add saved graphs and charts as panels to your dashboard.

  1. Click either:

    • Create panel: The new visualization dialog appears. Choose items to create your visualization.

    • Add from library: Add saved graphs and charts from the library. Click a visualization name in the list to add as a new panel to the dashboard draft

  1. Give the dashboard a name and click Save to save your new dashboard.

View or edit a dashboard

  1. You can work with your dashboard in two modes:

    View mode

    View dashboard panels.

    Edit mode

    When you are creating a new dashboard, you work in edit mode until you save the dashboard. If you are editing a saved dashboard, click Edit at the top of the page to modify the panels or reposition them.

Working in View Mode

In View mode, each panel has the following controls that appear when you hover over them:

Click to see the ellipsis menu:

Options Description
Explore underlying data To gain insight to the data, open the underlying panel or data series documents in Discover. The panel documents that you open in Discover have the same time range and filters as the source panel.
Customize time range Set a new time range for the visualization
Inspect Inspect data and download as a csv file.
Maximize panel See panel in full screen.

Click to toggle the legend in the panel display.

Working in Edit Mode

In the dashboard page click the Edit button in the upper right hand of the screen to enter Edit Mode.

Each panel has the following controls that appear when you hover over them:

Hover over the top bar of the panel to display the move arrows . You can move the panel to another location in the dashboard.

Click to adjust the size of the panel.

Click to toggle the legend in the panel display .

Click to display the options menu:

Options Description
Edit visualization Opens the editor so you can make changes to the panel.
Clone panel Cloned panels appear next to the original panel, and move the other panels to provide a space on the dashboard.
Edit panel title Edit the panel title.
...more

enables the following additional options:

  • Customize time range

  • Inspect

  • Maximize panel

  • Replace panel

  • Delete from dashboard

Create drilldown Drilldowns enable you to define new behaviors for interacting with panels. You can add multiple actions and override the default filter.

When you're done customizing your dashboard, click Save and enter a name and description for your dashboard.

Tip: Optionally, select Store time with dashboard to update the global date range to the date range currently selected, when you edited the dashboard.

Click Cancel at the top of the page to exit the editing mode and discard your changes.

TIP: New custom dashboards created are added to the end of the list of saved dashboards. To find yours quickly you can enter the dashboard name in the search field.

Dashboard options

Use the following additional options at the top of the page to manage your dashboard:

Full screen View mode only Show dashboard in full screen.
Options Edit mode only

Click to:

  • Use margins between panels

  • Show panel titles

Share Both Edit and View modes

Display links to either share a saved dahsboard or a snapshot.

Use the Embedded iframe URL to embed this chart in another location.

Tip: Full link URLs may be long. Click Copy to copy the full URL to the clipboard, or Short URL to display a shorter URL that's easier to share.

Clone View mode only Make a copy of the dashboard currently displayed for editing.
Library Edit mode only

Add panel from library

Cancel Edit mode only Close edit view
Save Edit mode only Save dashboad

Add a filter

Do the following:

  1. Click + Add Filter. For example:

  2. In the Edit filter dialog, enter a field name, operator, and value.
  3. Click Save to add the selected values to the filter.

The field and value is added to the filter list above the data type dropdown and field lists.

For example:

At the top of the page, click any of the following to manage the filtered data:

New Discard all of your changes and start a new filter from scratch.
Save

Save your filter so that you or other users can return to it later on.

Open Click to view a list of saved searches.
Share

Display links to either share a saved search or a snapshot.

Tip: Full link URLs may be long. Click Copy to copy the full URL to the clipboard, or Short URL to display a shorter URL that's easier to share.

Inspect Provides information about the data and the Elasticsearch query used to retrieve it.
Date selector Define the date range for the data displayed. For details, see Change date ranges.

Visualize data straight from the Discover page

Go to Visualize in order to create graphs based on a specific filter field.

Do the following:

Jump directly from the Discover page of ART to Visualize in order to create graphs based on a specific filter field.

  1. In Discover page, hover over any filter name in the Selected or Available Fields list to display a bar chart of the values for that field.

    For example:

  2. Click Visualize to display the selected field in the Visualize area.

For more details, see Visualize data.

Index fields by data type

Each data type provides a different set of fields for discovering and visualizing data in ART.

For details, see:

Change date ranges

Date range selectors enable you to filter according to a specific date range.

Do any of the following:

  • Use the < > arrows to move back and forth between incremental date ranges.
  • Click the selected date range, shown in the center of the < > arrows, to select a more complex date range.

    The Time Range area expands, providing you with a series of options of the following types:

    Now

    Provides quick options, like Today, Previous month, Last 24 hours, or Last 2 years.

    Relative

    Enables you to define date ranges from a specified time ago or from now, to another specified time ago or from now.

    Absolute Enables you to select specific start and end dates.

Click Go to update the data displayed based on your date range selections.

For example:

Manage ART objects

The ART Management area enables you to manage saved queries, visualizations, and dashboards.

Warning: The Management area also enables you to configure the Kibana Index and Advanced Settings that control ART functionality.

We recommend that you do not customize the default Index and Advanced Settings to ensure that ART continues to work as expected. For more details, see the Kibana documentation.

Do the following:

  1. Click the hamburger icon (☰) at the top left of the screen and click Management.

  2. Click Stack Management, and then click Saved objects in the left hand menu.

  1. Click Type and select one of the following items:

    • Dashboards. Manage saved dashboards. For more details, see Dashboards.
    • Searches. Manage saved searches. For more details, see Discover data.
    • Visualizations. Manage saved graphs and charts. For more details, see Visualize data.
  2. Do any of the following:

    Find your object Browse the list or enter a name in the search field to locate your object.
    Edit object settings

    Click an object name in the list to make changes, such as to the object title.

    This option also enables you manage advanced settings, such as supporting JSON code.

    We recommend making advanced changes like these only if you are an advanced Kibana user.

    Open object in ART Hover over the object name, and click the eye icon to open it Discover, Visualize, or Dashboard areas.
    Delete objects

    Select one or more objects in the list, and click Delete to delete the selected items.

    In the warning dialog that appears, click Delete ... to confirm the deletion.

    Export objects

    Select one or more objects in the list and click Export to save the relevant JSON data locally.

    To export JSON data for all objects, click Export Everything at the top of the page.

    Import

    Create ART objects by importing a JSON file. At the top of the page, click Import and select a JSON file to import.

Troubleshoot ART

If you run into issues when using the AlgoSec Reporting tool, you may want to check the relevant log files.

ART-related logs are created for the Elastic, Kibana, and Logstash services in the /var/log directory on the AFA machine.