A report defines how the data collected by a query is presented. The default report is a tabular report that reflects the structure of the query, with each attribute displayed in a separate column. All presentation components of a tabular report (the column headings, for example) can be customized using the Report Builder. In addition, all graphical reports are defined using the Report Builder.
Before using the Report Builder, create a query using the Query Builder. See Queries, earlier in this section.
Tabular reports are limited to 5,000 rows of output, but when included in a workflow process, any number of rows can be exported from the report task to a CSV or CEF file. See Compliance Workflow Automation.
To access a report definition, your Guardium user account must be assigned a security role that is also assigned to that report definition. Reports that you cannot access will not display in a list of reports.
Do one of the following to open the Report Finder:
Users with the admin role: Select Tools > Report Building > Report Builder.
All Others: Select Monitor/Audit > Build Reports > Report builder.
Search for a report by taking one or more of the actions described below. The results display in the Report Search Results panel.
To locate a specific report, select that report
from the Report Title list. The
selected report will display immediately in the Report Search Results
panel.
For the remaining types of search, click the Search
button after making entries in one or more fields, or just click the Search button to list all reports available
for your Guardium account.
To list all reports that use a specific query, select that query from the Query list.
To list monitor reports only, mark the Monitor box.
To list all reports for a specific chart type, select it from the Chart Type list.
If the search locates any reports, they display in the Report Search Results panel. Click any of the following buttons:
New - See Create a Report.
Clone - See Clone a Report.
Modify - See Modify a Report.
Add to My New Reports - See Generate a Tabular Report Quickly, under the Queries topic.
Add to - See Generate a Tabular Report Quickly, under the Queries topic.
Drilldown Control - See Modify the Drill-Down Reports Menu for a Report.
Regenerate Portlet - Click this button after changing the runtime parameters for the query on which the report is based.
Roles - See Security Roles.
Remove - See Remove a Report.
Comment - See Comments.
Do one of the following to open the Report Finder:
Users with the admin role: Select Tools - Report Building - Report Builder.
All Others: Select Monitor/Audit - Build Reports - Report builder.
Click the New button to open the Create Report panel.
From the Query list, select the query to be used by the report.
Enter a unique name for the report in the Report Title field.
Do one of the following:
To create a default tabular report (default column headings, runtime parameter prompts, etc.), click the Generate Tabular button and continue with Create a Default Tabular Report, below
To customize presentation components, click the Next button and continue with Customize the Report Presentation, below.
Continued from Create a Report, above.
To add the report to the My New Reports layout, click Add to My New Reports.
To add the report to any other layout, navigate to that
layout, click the 
Customize button, and refer to the
Portal Customization topic in the Common
Tools book for instructions on how to add a portlet to a layout.
To use the report in an Audit Process, see Compliance Workflow Automation.
Optionally assign roles to the report (see Security Roles).
Continued from Create a Report, above.
In the Report Columns panel,
Optionally override the Report Title. The default is from the report definition (see above). You can modify the title on most subsequent panels.
Optionally override any Column Description (the column headings).
Click the Next button to open the Report Parameter Description panel, and optionally override any parameter description.
Click the Next button to open the Report Attributes panel:
Optionally enter a Refresh Rate (in seconds) for the report. Leave the value blank to
Mark the Tabular or Chart button.
Click Next. If creating a graphical report, go to Create a Graphical Report to compete the report definition.
In the Report Color Mapping panel, set the background fill color for each column to have special coloring, as follows:
Select a column from the Column list.
Select an operator from the Operator list.
In the Value column, enter a specific value, or if in group has been selected as the operator, select the group from the list.
Click on the Color box and select the color you want from the pop-up Color Picker window.
Click the Add button.
Click the Next button to open the Submit Report panel, and continue with the Submit Report Definition procedure, below.
Continued from Customize the Report Presentation, above.
In the Report Chart Type panel, select the Chart Type and click the Next button.
If working with a report that can also be a monitor, the Report Observations Parameter panel displays (if it does not display, skip to the next step):
In the Number of Observations box, enter the number of observations to display.
Click the Next button to continue to the Report Chart Type panel.
If the Report Chart Type panel is not displayed, skip this step (all necessary data has been entered) Select the type of chart for the report from the Chart Type list.
Click the Next button to open the Report Presentation Parameters panel.
Review the parameters, which will vary for each type of chart.
Optionally override any of the default settings for the chart type selected.
Optionally click the Preview button to display the chart layout with the current parameters selected.
Repeat this process until the chart has the desired attributes.
Note: When graphical reports are exported for use on other systems, the presentation parameter settings (i.e., colors, fonts, titles, etc.) are not exported. Graphical reports that are imported use the default presentation parameter settings for the Guardium system doing the importing.
Click the Next button to continue to the Submit Report panel, and continue with the Submit Report Definition procedure, below.
Continued from create and customize procedures above.
Click the Save button.
Optionally add comments (see Comments).
Optionally assign roles (see Security Roles).
Find the report to be modified. See Find a Report for Editing, above.
Click the Modify button to open the Report Columns panel.
Continue with Customize the Report Presentation, above.
Find the report to be cloned. See Find a Report for Editing, above.
Click the Clone button to open the Report Columns panel.
Enter a new name for the cloned report, in the Report Title box. You can enter the new name on any of the subsequent screens - the only requirement is that the new name must be entered before the cloned report can be saved.
Continue with Customize the Report Presentation, above.
Be aware that you cannot remove predefined reports, and you cannot remove reports that are used in Audit Processes.
Find the report to be removed. See Find a Report for Editing, above.
Click the Remove button to remove the report.
Once a report has been saved and a portlet generated, follow the procedure outlined below to place the report on a pane. All run-time parameters are empty in a report definition. Therefore, after placing a report on a pane, you need to set run-time parameters for the report before it will be populated with data (see Set Report Parameters, below).
For more comprehensive information about customizing your portal by defining tabs, menus and portlet layouts, see Portal Customization in the Common Tools book.
Alternatively, from the Report Finder panel, select the report and use one of the following methods to add that report to a pane:
Add to My New Reports - See Generate a Tabular Report Quickly, under the Queries topic.
Add to - See Generate a Tabular Report Quickly, under the Queries topic.
To place a report on a pane:
Select Monitor/Audit > Build Reports, and click the Place report on portal page button. The Customize Pane panel displays.
Click the Add Pane button. You are prompted to supply a name.
Enter a new name, and click the Apply button. The new pane is added to the list of panes.
To place a portlet on the new pane, click its name to open the Customize Pane panel for this pane.
Click the Add Portlet button to open a list of all portlets available. Optionally use the Filter portlets by category button to limit the number of portlets displayed. If there are more portlets than can be displayed on a single page, scroll through the list of portlets using Previous and Next buttons at the bottom of the panel.
Mark the checkbox beside the portlet you to be included on the pane, and click the Apply button. This action places the portlet in the default location for the pane being customized.
Click the Save and Apply button, which returns to the list of panes in the Customize Pane panel.
Click the Apply button to save the modified pane. The new pane name will appear as a new tab.
Click on the new tab to open the new pane. This pane contains only the portlet that was just added. As mentioned earlier, when placing a portlet on a page, all run-time parameters are empty, including the date range for the report. To run the report, you will need to set the date range and possibly set other run-time parameters.
Note: From a Central Manager portal you can view reports that use data on a managed unit. If the managed unit becomes unavailable (due to a network outage, for example), the pane on which the report resides cannot be re-drawn. For this reason, when using remote data sources for a report, it is best to use a menu layout, with one report per menu entry, so that the unavailability of one remote source does not prevent any other reports from being displayed.
There are two types of report parameters:
A run-time parameter provides a value to be used in a query condition. There is a default set of run-time parameters for all queries (see the table below), and any number of run-time parameters can be defined in the query used by the report (see Query Conditions Overview).
A presentation parameter describes a physical characteristic the report; for example whether a graphical report includes a legend or labels, or what colors to use for an element. All presentation parameters are provided with initial settings when you define a report.
To set report parameters:
Click the 
(Customize) button on the report tab.
In the Customize Portlet panel, enter run-time and presentation parameters in the boxes provided, as necessary for the task to be performed.
Click the Update button at the bottom of the panel.
The following run-time parameters are present for all reports.
|
Run-time Parameter |
Default and Description |
|
GROUPING_SUB_TYPE |
None. If the report contains one or more items of a type for which groups have been defined (objects, for example), the report results can be summarized, displaying one row for each group defined for that item type. To use this option, select the type from the GROUPING_SUB_TYPE list. For example, if the report contains commands, select Commands from the GROUPING_SUB_TYPE list, and there will be a separate row for each Commands group for which occurrences have been counted. Be aware that groups can have overlapping membership. |
|
QUERY_FROM_DATE |
None for a new report, varies for default reports. The starting date for the report is always required. |
|
QUERY_TO_DATE |
None for a new report, varies for default reports, though the default is almost always NOW. This is the ending date for the report, and is always required. |
|
REMOTE_SOURCE |
None. In a Central Manager environment, you can run a report on a managed unit by selecting that Guardium appliance from the Remote Data Source list. |
|
SHOW_ALIASES |
None (meaning the system-wide default will be used). Select the On button to always display aliases, or the Off button to never display aliases. Select the default button to revert to the system-wide default (controlled by the administrator) after either the On or Off button has been used. |
For tabular reports, there are two standard presentation parameters, and these are described in the table below. For graphical reports, there are many additional presentation parameters, but the set used varies depending on the type of graph being produced (bar chart, pie chart, etc.). Those are not described here.
|
Presentation Parameter |
Default and Description |
|
fetchSize |
20. The number of rows to display in the report portal panel. |
|
refreshRate |
0 (zero). The number of seconds after which the data is to be refreshed. Zero means that the data will not be refreshed. |
To view a report, select the tab or menu entry for the report. While viewing the report, the following options are available:
To locate a report portlet that has already been placed on the portal, use either of the following tools in the upper right portion of the portal:
|
|
Opens a search window. Enter the report or application name, or part of the name in the text box, and click the Search button. Then click on any of the displayed portlets to navigate to that portlet in the main window. Hint: This search operation searches for each word that you enter, separately. To limit the list of portlets returned, enter only the most important word or words from the name of the portlet you are looking for. |
|
|
Opens a graphical map of your portal. Navigate the tabs and menu entries as you would with a directory listing. |
By default, the drill-down menu for a report includes all reports with run-time parameters that can be supplied by attributes from the report, given the usual security role restrictions. To disable or enable any reports on the drill-down menu for a report:
Locate the report (see Find a Report for Editing, above).
Click the Drilldown Control button to open the report’s Drilldown Control panel.
Mark the checkbox for any report to be disabled, or clear the checkbox for any report to be enabled.
Click the Apply button. The system displays a message saying your changes were applied successfully.
Click the Done button when you are finished.
There are several ways to refresh report data on the portal:
Click the 
(Refresh) button on the toolbar at the bottom
of the report.
Click the tab title or the menu entry for the pane containing
the report, or do anything else to navigate away from the pane and back
to it, taking care not
to click the (Customize) button on a tab, menu or report, since
that opens the Customize Portlet panel.
Use any toolbar button to print a report, download report data, or write the report to a PDF file (the report data will be refreshed before performing any of these actions).
Set a time interval for periodic refreshing, by setting the refreshRate parameter value in the Customize Portlet panel. To perform this task:
Click the (Customize) button for on the report title
tab.
In the Customize Portlet panel, set the refreshRate parameter to the number of seconds after which the report data is to be updated. The default value of zero indicates that the report data will not be refreshed on a scheduled basis.
Click the Update button.
To change the sorting sequence of tabular data, click the column label for the column to be used as a sort key. The data will be re-displayed, sorted in ascending sequence on the column selected. To sort the data in descending sequence, click the column heading a second time.
Note that sorting is always performed on the actual data values, ignoring any aliases that may have been defined.
To determine if drill-down reports are available for a report displayed on the portal, hold the mouse pointer over any row of data on the report. If drill-down reports are available, the message Double click for drill down and record details displays.
To be available as a drill-down report:
All of the run-time parameters for the drill-down report must be available from the report being viewed.
If security roles have been assigned, you must have access to the drill-down report.
On the popup menu for a default tabular report, all of the reports that satisfy the above criteria will be available, but the person defining the report (using the report builder) can limit what drill-down reports will be included in the drop-down menu.
To open a drill-down report for any row of data:
Double-click on that row.
Select a report from the popup menu.
In addition to any user defined or pre-defined reports that may be available, the popup menu may contain several additional items, as follows:
Record Details - A special report that displays the details of what is being counted, either for the main entity, or if sub totaling is being performed by group type, for each group member.
Alias Definition - If aliases are enabled for the report, this drill-down menu selection opens the alias Quick Definition window, which allows you to define an alias for any value displayed.
Show SQL, or Show SQL with Values - If the inspection engine has been configured to capture values, complete SQL statements (including values representing potentially sensitive information) will be displayed. If the inspection engine or the policy rule (depending on the situation) is not configured to capture values, no values can be displayed.
In many cases, you can continue to drill down to get additional information.
There are several options for downloading tabular report data to a CSV (comma-separated value) file or a PDF file. The buttons described below are located on the toolbar at the bottom of the report panel.
Click 
(Download Page Data) to download the data
currently displayed on the portal, in CSV format.
Click 
(Download All Data) to download the entire
report, in CSV format.
Click 
(Download PDF File) to download the entire
report. Adobe Acrobat Reader is required to view PDF files.
Note: Each time the Download All Data or Download PDF File button is clicked, the report data is refreshed.
Do one of the following to reformat the report data in a separate window:
To print only the data displayed on the page, click
the 
(Print Friendly Format) button on the report tab.
To open the complete report in a separate window
that is formatted for printing, click the 
(Full Printable Report) button on the toolbar
at the bottom of the report.
Do one of the following:
For any report, use your browser Print command to print the report.
For a tabular
report, click the 
(Print Page) button in the upper right corner of the
report.
A tree map presents tabular data in a graphical format - the greater the number of occurrences of a value, the larger the area that item occupies on the chart.
To display a tree map, click the 
(Display Tree Map) button. Two windows will
be opened: a tree map control panel, and a tree map window.
In the Tree Map window, area represents occurrences (the larger the area, the greater the number of occurrences. The outermost area of the tree includes everything, and is labeled All Data. The next layer of the tree report contains an area for each value of the first column.
To display information about any ring, hold the mouse pointer over that ring.
To zoom in or a ring, click on it. This is useful for more compressed reports where some of the columns may contain too little data to view at the outermost levels.
Use the following controls to modify the Tree Map display:
Click the Create new view button to create a separate view of the report data. You will be prompted to select a column for each grouping level, and to select the field used for the size calculations.
The Classic view is the default.
The Squarified view re-draws the tree map with the rings more nearly square.
The Border Size slider controls the space between rings. As you increase this size, you will have more room to display column names and values.
Use the controls of the Cushion panel to modify the coloration pattern and intensity level that will be applied to each ring of the graphic. Try experimenting with these controls.
In the Draw panel, click Color to display a yellow background, or Pattern to display a clear background.
Mark the Draw Titles box at the bottom of the panel to display column headings and values, or clear the box to remove them.
Open a report portlet for any report based on the query to be edited.
Click 
(Edit this Report's Query) in the tool bar
at the bottom of the report. You must be authorized to modify the query
that the report is based upon.
(Portal Search)
(Portal Map)