Reports

Reports Overview

A report defines how the data collected by a query is presented. The default report is a tabular report that reflects the structure of the query, with each attribute displayed in a separate column. All presentation components of a tabular report (the column headings, for example) can be customized using the Report Builder. In addition, all graphical reports are defined using the Report Builder.

Before using the Report Builder, create a query using the Query Builder. See Queries, earlier in this section.

Report Size Limitation

Tabular reports are limited to 5,000 rows of output, but when included in a workflow process, any number of rows can be exported from the report task to a CSV or CEF file. See Compliance Workflow Automation.

Find a Report for Editing

To access a report definition, your Guardium user account must be assigned a security role that is also assigned to that report definition. Reports that you cannot access will not display in a list of reports.

  1. Do one of the following to open the Report Finder:

  2. Search for a report by taking one or more of the actions described below. The results display in the Report Search Results panel.

If the search locates any reports, they display in the Report Search Results panel. Click  any of the following buttons:

Create a Report

  1. Do one of the following to open the Report Finder:

  2. Click the New button to open the Create Report panel.

  3. From the Query list, select the query to be used by the report.

  4. Enter a unique name for the report in the Report Title field.

  5. Do one of the following:

Create a Default Tabular Report

Continued from Create a Report, above.

  1. To add the report to the My New Reports layout, click Add to My New Reports.

  2. To add the report to any other layout, navigate to that layout, click the Customize button, and refer to the Portal Customization topic in the Common Tools book for instructions on how to add a portlet to a layout.

  3. To use the report in an Audit Process, see Compliance Workflow Automation.

  4. Optionally assign roles to the report (see Security Roles).

  5. Back to top

Customize the Report Presentation

Continued from Create a Report, above.

  1. In the Report Columns panel,

  2. Click the Next button to open the Report Parameter Description panel, and optionally override any parameter description.

  3. Click the Next button to open the Report Attributes panel:

  4. In the Report Color Mapping panel, set the background fill color for each column to have special coloring, as follows:

  5. Click the Next button to open the Submit Report panel, and continue with the Submit Report Definition procedure, below.

Create a Graphical Report

Continued from Customize the Report Presentation, above.

  1. In the Report Chart Type panel, select the Chart Type and click the Next button.

  2. If working with a report that can also be a monitor, the Report Observations Parameter panel displays (if it does not display, skip to the next step):

  3. If the Report Chart Type panel is not displayed, skip this step (all necessary data has been entered) Select the type of chart for the report from the Chart Type list.

  4. Click the Next button to open the Report Presentation Parameters panel.

Note: When graphical reports are exported for use on other systems, the presentation parameter settings (i.e., colors, fonts, titles, etc.) are not exported. Graphical reports that are imported use the default presentation parameter settings for the Guardium system doing the importing.

  1. Click the Next button to continue to the Submit Report panel, and continue with the Submit Report Definition procedure, below.

Submit Report Definition

Continued from create and customize procedures above.

  1. Click the Save button.

  2. Optionally add comments (see Comments).

  3. Optionally assign roles (see Security Roles).

Modify a Report

  1. Find the report to be modified. See Find a Report for Editing, above.

  2. Click the Modify button to open the Report Columns panel.

  3. Continue with Customize the Report Presentation, above.

Clone a Report

  1. Find the report to be cloned. See Find a Report for Editing, above.

  2. Click the Clone button to open the Report Columns panel.

  3. Enter a new name for the cloned report, in the Report Title box. You can enter the new name on any of the subsequent screens - the only requirement is that the new name must be entered before the cloned report can be saved.

  4. Continue with Customize the Report Presentation, above.

Remove a Report

Be aware that you cannot remove predefined reports, and you cannot remove reports that are used in Audit Processes.

  1. Find the report to be removed. See Find a Report for Editing, above.

  2. Click the Remove button to remove the report.

Place a Report on a Pane

Once a report has been saved and a portlet generated, follow the procedure outlined below to place the report on a pane. All run-time parameters are empty in a report definition. Therefore, after placing a report on a pane, you need to set run-time parameters for the report before it will be populated with data (see Set Report Parameters, below).

For more comprehensive information about customizing your portal by defining tabs, menus and portlet layouts, see Portal Customization in the Common Tools book.

Alternatively, from the Report Finder panel, select the report and use one of the following methods to add that report to a pane:

To place a report on a pane:

  1. Select Monitor/Audit > Build Reports, and click the Place report on portal page button. The Customize Pane panel displays.

  2. Click the Add Pane button. You are prompted to supply a name.

  3. Enter a new name, and click the Apply button. The new pane is added to the list of panes.

  4. To place a portlet on the new pane, click its name to open the Customize Pane panel for this pane.

  5. Click the Add Portlet button to open a list of all portlets available. Optionally use the Filter portlets by category button to limit the number of portlets displayed. If there are more portlets than can be displayed on a single page, scroll through the list of portlets using Previous and Next buttons at the bottom of the panel.

  6. Mark the checkbox beside the portlet you to be included on the pane, and click the Apply button. This action places the portlet in the default location for the pane being customized.

  7. Click the Save and Apply button, which returns to the list of panes in the Customize Pane panel.

  8. Click the Apply button to save the modified pane. The new pane name will appear as a new tab.

  9. Click on the new tab to open the new pane. This pane contains only the portlet that was just added. As mentioned earlier, when placing a portlet on a page, all run-time parameters are empty, including the date range for the report. To run the report, you will need to set the date range and possibly set other run-time parameters.

Note: From a Central Manager portal you can view reports that use data on a managed unit. If the managed unit becomes unavailable (due to a network outage, for example), the pane on which the report resides cannot be re-drawn. For this reason, when using remote data sources for a report, it is best to use a menu layout, with one report per menu entry, so that the unavailability of one remote source does not prevent any other reports from being displayed.

Set Report Parameters

There are two types of report parameters:

To set report parameters:

  1. Click the (Customize) button on the report tab.

  2. In the Customize Portlet panel, enter run-time and presentation parameters in the boxes provided, as necessary for the task to be performed.

  3. Click the Update button at the bottom of the panel.

Standard Run-Time Parameters

The following run-time parameters are present for all reports.

Run-time Parameter

Default and Description

GROUPING_SUB_TYPE

None. If the report contains one or more items of a type for which groups have been defined (objects, for example), the report results can be summarized, displaying one row for each group defined for that item type. To use this option, select the type from the GROUPING_SUB_TYPE list. For example, if the report contains commands, select Commands from the  GROUPING_SUB_TYPE list, and there will be a separate row for each Commands group for which occurrences have been counted. Be aware that groups can have overlapping membership.

QUERY_FROM_DATE

None for a new report, varies for default reports. The starting date for the report is always required.

QUERY_TO_DATE

None for a new report, varies for default reports, though the default is almost always NOW. This is the ending date for the report, and is always required.

REMOTE_SOURCE

None. In a Central Manager environment, you can run a report on a managed unit by selecting that Guardium appliance from the Remote Data Source list.

SHOW_ALIASES

None (meaning the system-wide default will be used). Select the On button to always display aliases, or the Off button to never display aliases. Select the default button to revert to the system-wide default (controlled by the administrator) after either the On or Off button has been used.

Standard Presentation Parameters (Tabular Report)

For tabular reports, there are two standard presentation parameters, and these are described in the table below. For graphical reports, there are many additional presentation parameters, but the set used varies depending on the type of graph being produced (bar chart, pie chart, etc.). Those are not described here.

Presentation Parameter

Default and Description

fetchSize

20. The number of rows to display in the report portal panel.

refreshRate

0 (zero). The number of seconds after which the data is to be refreshed. Zero means that the data will not be refreshed.

View Reports

To view a report, select the tab or menu entry for the report. While viewing the report, the following options are available:

Find a Report on the Portal

To locate a report portlet that has already been placed on the portal, use either of the following tools in the upper right portion of the portal:

(Portal Search)

Opens a search window. Enter the report or application name, or part of the name in the text box, and click the Search button. Then click on any of the displayed portlets to navigate to that portlet in the main window.

Hint: This search operation searches for each word that you enter, separately. To limit the list of portlets returned, enter only the most important word or words from the name of the portlet you are looking for.

(Portal Map)

Opens a graphical map of your portal. Navigate the tabs and menu entries as you would with a directory listing.

Modify the Drill-down Reports Menu for a Report

By default, the drill-down menu for a report includes all reports with run-time parameters that can be supplied by attributes from the report, given the usual security role restrictions. To disable or enable any reports on the drill-down menu for a report:

  1. Locate the report (see Find a Report for Editing, above).

  2. Click the Drilldown Control button to open the report’s Drilldown Control panel.

  3. Mark the checkbox for any report to be disabled, or clear the checkbox for any report to be enabled.

  4. Click the Apply button. The system displays a message saying your changes were applied successfully.

  5. Click the Done button when you are finished.

  6. Back to top

Refresh Report Data

There are several ways to refresh report data on the portal:

Re-Sort Tabular Data

To change the sorting sequence of tabular data, click the column label for the column to be used as a sort key. The data will be re-displayed, sorted in ascending sequence on the column selected. To sort the data in descending sequence, click the column heading a second time.

Note that sorting is always performed on the actual data values, ignoring any aliases that may have been defined.

View Drill-Down Reports

To determine if drill-down reports are available for a report displayed on the portal, hold the mouse pointer over any row of data on the report. If drill-down reports are available, the message Double click for drill down and record details displays.

To be available as a drill-down report:

On the popup menu for a default tabular report, all of the reports that satisfy the above criteria will be available, but the person defining the report (using the report builder) can limit what drill-down reports will be included in the drop-down menu.

To open a drill-down report for any row of data:

  1. Double-click on that row.

  2. Select a report from the popup menu.

In addition to any user defined or pre-defined reports that may be available, the popup menu may contain several additional items, as follows:

In many cases, you can continue to drill down to get additional information.

Download Report Data to a CSV or PDF File

There are several options for downloading tabular report data to a CSV (comma-separated value) file or a PDF file. The buttons described below are located on the toolbar at the bottom of the report panel.

Note: Each time the Download All Data or Download PDF File button is clicked, the report data is refreshed.

Print a Report

  1. Do one of the following to reformat the report data in a separate window:

  2. Do one of the following:

Display a Tree Map

A tree map presents tabular data in a graphical format - the greater the number of occurrences of a value, the larger the area that item occupies on the chart.

To display a tree map, click the (Display Tree Map) button. Two windows will be opened: a tree map control panel, and a tree map window.

Use Tree Map Window

In the Tree Map window, area represents occurrences (the larger the area, the greater the number of occurrences. The outermost area of the tree includes everything, and is labeled All Data. The next layer of the tree report contains an area for each value of the first column.

Use the Tree Map Control Panel

Use the following controls to modify the Tree Map display:

Open Query for Editing from Report Portlet

  1. Open a report portlet for any report based on the query to be edited.

  2. Click (Edit this Report's Query) in the tool bar at the bottom of the report. You must be authorized to modify the query that the report is based upon.

  3. Back to top