Web Security Service

help Help pdfs
English

Create a Custom Report

Although the
Web Security Service
 provides dozens of pre-defined reports, you might have the need to create a new report that focuses on exact parameters. The
WSS
 portal provides a wizard that creates custom reports. For each new report, you define:
  • What type of data the report summarizes (for example, a specific user).
  • Specific dates or other refining filters.
  • The look of the report (for example, the graphic type or number of columns).

Use Case

For example, to analyze suspected acceptable web use abuses, you want to generate a report that lists, by location, the verdicts denied by policy that occurred over a time frame for four specific users.

Procedure

The following procedure illustrates all aspects of the New Report wizard and provides examples according to the above
Use Case
.
  1. There are two methods to begin the New Report wizard. In Solutions Mode:
    • From any
      Dashboard
      , select
      Common Tasks > Report Tasks > New Report
      .
      Create New Report from DB
    • From any
      Reports
       page (not individual reports), click
      New Report
      .
      Create New Report from Reports page
  2. The first page of the wizard,
    Report Information
    , prompts you to define up to two summary fields (how the new report sorts) and specify how many entries display for each field.
    New Report wizard 1
    1. Name
       the report. For example,
      User Investigation
      .
    2. Select the first
      Summarize By
       sorting criteria. To add a second level sort criteria, click
      Add Level
      . To continue with the
      Use Case
       stated in the introduction above, this report summarizes by
      Location
      .
    3. Click
      Next
      .
  3. The second report construct is
    Set Report Filter
    . Specify the time span of data from which to generate the report and select the data points that display in the report.
    New Report Wizard page 2
    1. (Optional) The default
      Date
       range is
      All Dates
      . This means the report generates up to 90 days, which is the current
      WSS
       maximum storage capacity. To narrow the time span, select a
      Date is
       option and use the calendars to specify the range. Show option descriptions...
      • Since
        —Generate the report for all dates since the specified date.
      • Before
        —Generate the report for all dates after the specified date.
      • Current
        —Generate the report for the same
        hour(s)
        ,
        day(s)
        ,
        week(s)
        , or
        month
         as when the report runs.
      • Previous
        —Generate the report for the previous specified
        hour(s)
        ,
        day(s)
        ,
        week(s)
        , or
        month
        .
      • Current and Previous
        —Generate the report that includes the current
        hour(s)
        ,
        day(s)
        ,
        week(s)
        , or
        month
         plus the previous specified same unit .
      • Custom
        —Generate the report for a specified date range.
      This example specifies a
      Custom
       date range.
    2. (Optional) Add filter criteria. This is what limits the scope of the custom report.
      • The first field is the data point. For example,
        User
        ,
        Client IP
        , or
        Protocol
        .
      • The second field is the matching condition. Show condition descriptions...
        • Is
          —The report includes data for the matching value(s).
        • Is not
          —The report includes data for all values except the specified value.
        • Contains
          —Only display data that matches the specified string. For example, User Agent >
          Contains
           > Firefox.
        • Does not contain
          —Display all data that does not contain the specified string.
        • Starts with
          —Display all data that begins with the specified string.
        • Does not start with
          —Exclude all data that begins with the specified string.
        • Ends with
          —Display all data that ends with the specified string.
        • Does not end with
          —Exclude all data that ends with the specified string.
      • The third field is a specific matching value that either you enter or you select. This depends on the combination of the selected data point and filter criteria. For example, if you select
        User
         and
        Is
         and have authenticated users, select a matching value from the populated list. If you select
        User
         and
        Contains
        , you must enter the matching value.
    3. Click the
      +
       icon to add more than one matching entry per data point
    4. (Optional) Click
      Add Criteria
       to add more conditions.
      This
      Use Case
       specifies four
      User
       names and adds
      Verdict is policy_denied
       criteria.
    5. Click
      Next
      .
  4. The third report construct is how many data columns display.
    New Report Wizards page 3
    1. Select which columns display in the report.
    2. Select which column is used to sort and selecting
      Ascending
       (highest value first) or
      Descending
       (lowest value first).
    3. Click
      Next
      .
  5. The fourth report construct is the type of graph displayed in the report. Select the graph type that you believe best serves the report data. From within the generated report, you have the option to turn off the graph display or change its type.
    The default option is for the graphic to display data according the what was selected as the
    Sort By
     option in
    Step 5.b
    . To change this default, click
    Chart the following columns
     and select options.
    Click
    Next
    .
  6. The report is ready to run. You have two options.
    New Report Wizard screen 4
    • To run this report one time, clear the
      Save report to report list for running later
       option and click
      Run Report
      .
    • To run this report again in the future, select a visibility option:
      • Select a group from
        My Groups
        . The report displays in the selected group, but only you are able to run it.
      • Select a group from
        Shared Groups
        . The report displays in the selected group and is visible to anyone with
        WSS
         portal access credentials.
  7. Click
    Run Report.
If the generated report does present expected results, select
Options >  Report
 (next to the report name) and alter the criteria. See the
Related Topic
 link for more information.