Working with a single report

When you open a report, it populates with data from all data connectors. The report includes the data points that are listed in the Reports page. This task outlines the actions that you can take on individual reports.

• The top right of the report allows you to configure report settings and complete other high-level actions:
  • If you have made changes to the report, click Save to save the changes - or click Undo changes to undo the changes.
  • To adjust the settings for the current report, click Report settings:
    • When you set the time range of data to display in the report, the default time is the Connection start (local time). To change the time used, select it from the list.
    • Table join optimization: When this option is activated, reports will run without joins to the SESSION table, by default. The option can improve report runtime for data coming from Guardium collectors. To improve report performance, select Active (by default, this is set to Global settings value applied (adopting the global setting for all tenants)).
      Warning: If used in a report that contains data from direct streamed data sources, some fields may be missing data. The default can be overridden for specific reports in the report editor.
    • Enable queries that use pipeline plans for online reporting: This setting can improve performance by reducing the time that it takes for reports to load. Use this setting if you have large amounts of data (for example, a report that gathers data over a long time period - or a scheduled report). By default, this is set to Global settings value applied (adopting the global setting for all tenants). To disable pipeline queries for this report, select Inactive - and to enable all pipeline queries for this report, select Active.
      Note: Pipeline queries often negatively affect the performance queries with sorts and aggregation. In addition, queries that return a small amount of data may also take a long time to execute. For these reports, consider disabling this feature to improve performance.
  • To select the report as a favorite, click the Select as favorite star icon. This causes the report to appear at the top of the list of reports. In addition, the report will appear in the Favorite reports dashboard card.
  • To download the report, click Download file. A dialog box opens with the default selected Download the results on the current page. If you select this option, you can download the results to a comma-separated values (CSV) file. Or, you can download all results in the report by selecting Download all results. With this option selected, you can download a CSV or PDF file.

    Click Download file to save the file to your file system.

    By default, Guardium Insights exports a maximum number of results to the file. To change the maximum number of exported results, modify Maximum results exported to a file from an online report or PDF report maximum rows in the Tenant settings page.

  • To share a report, click Share link. A dialog box opens where you can copy the URL of the report so that you can share it with others. The link can be opened on any supported browser and viewed by users who have adequate permissions.
  • Roles: If you have full rights to a report, you can modify all of the report properties, delete it, and modify the roles. To set which roles have access to the report, click Roles. The Assign roles dialog box opens, where you can select View access and Full access check boxes for each Guardium Insights role that you want to be able to access the report. To learn more about roles, see Role management.
  • Version 3.4.x and laterCreate workflow: Select this to open the dialog box for creating scheduled audits and jobs. The dialog box will populate with the current report and you can create a job that runs the report according to a schedule that you set.
  • Version 3.3.xSchedule audit: Select this to open the dialog box for creating scheduled audits and jobs. The dialog box will populate with the current report and you can create a job that runs the report according to a schedule that you set.
  • To save the report as a new custom report, click Save As and follow the steps in Creating a custom report by copying an existing report.
• You can set the time range of data to display in the report as follows:
  • Now minus 3 hours (default time range)
  • Now minus 24 hours
  • Now minus 7 days
  • Version 3.4.x and laterNow minus 30 days
  • Custom (relative): Select to set a custom date and time range that is relative to the current day and time.
    • The Start of the range is the current date and time (now), minus a length of time that you choose. Choose the unit of time (minutes, hours, days, or months). Then, enter the time period in the field (or click the up and down arrows to increase or decrease the current value).
    • To specify the end of the range, set the End to Now or to Now minus and then set a time period as you did for the start of the range.
    • After making your time range choices, click Apply.
  • Previous full day
  • Version 3.4.x and laterPrevious full 3 days
  • Previous full week
  • Custom: Select to set a custom date range. Choose the Start date and time and End date and time that you want the report to reflect. After making your date range choices, click Apply.
• If you want to see a different report, click Reports and then choose the report that you want to see. You can narrow the list by using the case-insensitive Search field. You can also select one or more report tags to see only certain types of reports.
  Note: Each predefined report has one report tag that cannot be changed. Custom reports can have as many tags as you want.
• Version 3.4.x and laterTo add column items from the report to a group, click Add column items to group. And then, in the Add column items to group dialog box, select the column that contains the items that you want to add - and then select the group to add them to. To create a new group for adding the items to, click Create a group and then follow the instructions for creating a group. After the group has been created, ensure that it is selected in the Select group field. When you have completed the Add column items to group dialog box, click Add column items to group button.
• To modify the columns in the report, click Customize columns.
  1. Each column that is already included in the report is listed in the right pane with these menu actions:
     • Delete: Deletes the column from the report. All data types.
     • Rename: Click to rename the column for this report only. All data types.
     • Use default name: Click to revert to the original header (if the column was renamed). All data types.
     • Version 3.4.x and laterCreate variant: Creates a variant.
     • Set function: Lists the aggregation functions. You can select one function at a time per row. To change the selection, click another option. You can add a column multiple times with different functions. (If a column is defined twice identically, the system responds with an error when you try to save or apply the changes.) To clear a selection, click the x next to the function name, for example .
       • Count: All data types. Replaces the column value with the number of occurrences of the specific column value. For example, 25 rows have the timestamp 2021-03-11 10:04:59.0. The value in the Count (Exception timestamp) column is 25, and not the timestamp.
       • Sum: Numeric data only. Aggregates the rows that have identical data except for the column, and displays the sum of all values (of the aggregated rows) in this column.
       • Average: Numeric data only. Aggregates the rows that have identical data except for the column, and displays the average of all values in this column (of the aggregated rows).
       • Lowest: Numeric data and dates only. Aggregates the rows that have identical data except for the specific column, and displays the lowest of all the values in this column (of the aggregated rows).
       • Highest: Numeric data and dates only. Aggregates the rows that have identical data except for the specific column, and displays the highest of all the values in this column (of the aggregated rows).

     If you modify a column using any of these actions, click Apply to see them reflected in the report display.
  2. To add more columns:
     1. Select the columns that you want to see in the report (up to a maximum of 25), and click Add. Columns are added to the report in the order in which you select them.
        Tip: Use the case-insensitive Search field to narrow the list of column headers. The list of columns is filtered as you type.
     2. Modify the column display with the menu actions.
     3. Change the order of the columns by dragging them.
     4. Depending on the data, the final report might have duplicate rows, for example, one user, from one source address, to one destination address, and the same exception type. If you want to hide the duplicate rows, select Hide duplicate rows. If you select to hide the duplicate rows, you can select Add column to indicate number of duplicate rows to add a column that indicates the number of duplicate rows.
     5. Click Apply to view the report. You can continue to modify the report until you have the set of data you want.
• To see only the data point values that you are interested in, click Filter to Filter the report. You can also sort the report table by clicking column headers to see data points in the order that you want.
• Refresh or stop the generation of a report by using the Refresh and Stop actions. These actions are typically used for troubleshooting reports. For example, if a report is taking too long to run, you might want to stop it.