Viewing simulation results

After a simulation runs, the Results column displays a drop-down list that contains the dates when the simulation was generated. Simulation results are retained for 30 days. Results display in the Results column only after a simulation runs.

1. Click the Risks tab.
2. From the navigation menu, select Simulation > Simulations.
3. In the Results column, select the date and time of the simulation you want to view by using the list.
4. Click View Result. You can view the simulation result information, starting at step 1 of the simulation.

   The following information is provided:

   Table 1. Viewing simulation result information

   Parameter	Description
   Simulation Definition	The description of the simulation.
   Using Model	The name of the model against which the simulation was run.
   Simulation Result	The date on which the simulation was run.
   Step Results	The number of steps for the result that includes the step that is being displayed.
   Assets Compromised	The total number of assets that are compromised in this step and across all simulation steps. If the topology model includes data from an IP range of /32 defined as reachable, then IBM QRadar Risk Manager does not validate those assets against the database. Therefore, those assets are not considered in the Asset Compromised total. QRadar Risk Manager validates assets only in broader IP ranges, such as /24 to determine which assets exist.
   Risk Score	Risk score is a calculated value based on the number of results, steps, the number of compromised assets, and the importance factor that is assigned to the simulation. This value indicates the severity level that is associated with the simulation for the displayed step.

   Move your mouse pointer over the connection to highlight the path through the network, as defined by the subnet.

   The 10 most important assets display when you move your mouse over the connection.

   You can move your mouse pointer over a connection to determine the list of assets that are affected by this simulation.

5. View the Results for this Step table to determine the assets that are affected.

   Table 2. Viewing results for this step information

   Parameter	Description
   Approve	Used for approving simulation results. See Approving simulation results.
   Parent	The originating IP address for the displayed step of the simulation.
   IP	The IP address of the affected asset.
   Network	The network of the target IP addresses, as defined in the network hierarchy.
   Asset Name	The name of the affected asset, as defined by the asset profile.
   Asset Weight	The weight of the affected asset, as defined in the asset profile.

6. To view the next step of the simulation results, click Next Step.