Viewing visualizations

Protegrity provides out-of-the-box visualization for viewing the data. The configuration used for the visualization are provided here. This helps better understand and interpret the data shown on the various graphs and charts.

Note: Do not delete or modify the configuration or details of the visualizations provided by Protegrity. To customize the visualization, create a copy of the visualization and perform the customization on the copy of the visualization.

To view visualizations:

Log in to the Insight Dashboard.
From the navigation panel, click Visualize.
Create and view visualizations from here.
Click a visualization to view it.

Anonymization Information

Description: The usage information for the Anonymization feature.

Type: Date Table
Configuration:
- Index: pty_insight_analytics*anonymization_dashboard_*
- Metrics:
  - Aggregation: Sum
  - Field: metrics.anon_bytes
  - Custom label: Data Anonymized
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: request.id.keyword
    - Order by: Metric: Data Anonymized
    - Order: Descending
    - Size: 9999
    - Custom label: Job Id
  - Split rows
    - Aggregation: Terms
    - Field: metrics.source_bytes
    - Order by: Metric: Data Anonymized
    - Order: Descending
    - Size: 9999
    - Custom label: Total Data

Data Discovery Information

Description: The usage information for the Data Discovery feature.

Type: Date Table
Configuration:
- Index: pty_insight_analytics*discovery_dashboard_*
- Metrics:
  - Aggregation: Count
  - Custom label: Operations Performed
- Metrics:
  - Aggregation: Sum
  - Field: metrics.classified_bytes
  - Custom label: Sensitive Data Identified

User Activity Across Date Range

Description: The user activity during the date range specified.

Type: Heat Map
Filter: Audit Index Logtypes
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Value: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Date Histogram
    - Field: origin.time_utc
    - Minimum interval: Day
  - Y-axis
    - Sub aggregation: Terms
    - Field: protection.policy_user.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10
    - Custom label: Policy Users

Sensitive Activity by Date

Description: The data element usage on a daily basis.

Type: Line
Filter: Audit Index Logtypes
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Y-axis
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Date Histogram
    - Field: origin.time_utc
    - Minimum interval: Day
    - Custom label: Date
  - Split series
    - Sub aggregation: Terms
    - Field: protection.dataelement.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10
    - Custom label: Operation Count

Unauthorized Access By Username

Description: Top 10 Unauthorized Protect and Unprotect operation counts per user.

Type: Line
Filter 1: Audit Index Logtypes
Filter 2: protection.audit_code: is one of 1,3
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Terms
    - Field: protection.policy_user.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10
    - Custom label: Top 10 Policy Users
  - Split series
    - Sub aggregation: Filters
    - Filter 1-Protect: level=‘Error’
    - Filter 2-Unprotect: level=‘WARNING’

System Report - High & Critical Events of Audit Indices

Description: The chart reporting high and critical events from the Audit index.

Type: Vertical Bar
Filter: Severity Level : (High & Critical)
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Date Histogram
    - Field: origin.time_utc
    - Minimum Interval: Auto
    - Custom label: Date
  - Split series
    - Sub aggregation: Terms
    - Field: level.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10
  - Split series
    - Sub aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 50
    - Custom label: Server

System Report - High & Critical Events of Policy Logs Index

Description: The chart reporting high and critical events from the Policy index.

Type: Vertical Bar
Filter: Severity Level : (High & Critical)
Configuration:
- Index: pty_insight_analytics*policy_log_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Date Histogram
    - Field: origin.time_utc
    - Minimum Interval: Auto
    - Custom label: Date
  - Split series
    - Sub aggregation: Terms
    - Field: level.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 20
  - Split series
    - Sub aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 50
    - Custom label: Server

System Report - High & Critical Events of Troubleshooting Index

Description: The chart reporting high and critical events from the Troubleshooting index.

Type: Vertical Bar
Filter: Severity Level : (High & Critical)
Configuration:
- Index: pty_insight_analytics*troubleshooting_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Date Histogram
    - Field: origin.time_utc
    - Minimum Interval: Auto
    - Custom label: Date
  - Split series
    - Sub aggregation: Terms
    - Field: level.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10
  - Split series
    - Sub aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 50
    - Custom label: Server

Data Element Usage Intensity Of Users per Protect operation

Description: The chart shows the data element usage intensity of users per protect operation. It displays the top 10 data elements used by the top five users.

Type: Heat Map
Filter 1: protection.operation.keyword: Protect
Filter 2: Audit Index Logtypes
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Terms
    - Field: protection.policy_user.keyword
    - Order by: Metric: Sum of cnt
    - Order: Descending
    - Size: 5
  - Y-axis
    - Sub aggregation: Terms
    - Field: protection.dataelement.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10

Data Element Usage Intensity Of Users per Reprotect operation

Description: The chart shows the data element usage intensity of users per reprotect operation. It displays the top 10 data elements used by the top five users.

Type: Heat Map
Filter 1: protection.operation.keyword: Reprotect
Filter 2: Audit Index Logtypes
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Terms
    - Field: protection.policy_user.keyword
    - Order by: Metric: Sum of cnt
    - Order: Descending
    - Size: 5
  - Y-axis
    - Sub aggregation: Terms
    - Field: protection.dataelement.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10

Data Element Usage Intensity Of Users per Unprotect operation

Description: The chart shows the data element usage intensity of users per unprotect operation. It displays the top 10 data elements used by the top five users.

Type: Heat Map
Filter 1: protection.operation.keyword: Unprotect
Filter 2: Audit Index Logtypes
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Terms
    - Field: protection.policy_user.keyword
    - Order by: Metric: Sum of cnt
    - Order: Descending
    - Size: 5
  - Y-axis
    - Sub aggregation: Terms
    - Field: protection.dataelement.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10

Server Activity of Audit Index By Date

Description: The chart shows the daily count of all events by servers for specific time period from the audit index.

Type: Line
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Date Histogram
    - Field: origin.time_utc
    - Minimum interval: Day
  - Split series
    - Sub aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10

Server Activity of Policy Log Index By Date

Description: The chart shows the daily count of all events by servers for specific time period from the policy index.

Type: Line
Configuration:
- Index: pty_insight_analytics*policy_log_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Date Histogram
    - Field: origin.time_utc
    - Minimum interval: Day
  - Split series
    - Sub aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10

Server Activity of Troubleshooting Index By Date

Description: The chart shows the daily count of all events by servers for specific time period from the troubleshooting index.

Type: Line
Configuration:
- Index: pty_insight_analytics*troubleshooting_*
- Metrics: Y-axis:
  - Aggregation: Sum
  - Field: cnt
- Buckets:
  - X-axis
    - Aggregation: Date Histogram
    - Field: origin.time_utc
    - Minimum interval: Day
  - Split series
    - Sub aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Metric:Sum of cnt
    - Order: Descending
    - Size: 10

Connectivity status

Description: This pie chart display connectivity status for the protectors.

Type: Pie
Configuration:
- Index: pty_insight_analytics*protector_status_dashboard_*
- Metrics:
  - Slice size
    - Aggregation: Unique Count
    - Field: origin.ip
    - Custom label: Number
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: protector_status.keyword
    - Order by: Metric:Number
    - Order: Descending
    - Size: 10000

Policy_Deploy_Status_Chart

Description: This pie chart displays the deployment status of the policy.

Type: Pie
Filter: policystatus.type.keyword: POLICY
Configuration:
- Index: pty_insight_analytics*policy_status_dashboard_*
- Metrics:
  - Slice size
    - Aggregation: Unique Count
    - Field: _id
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: policystatus.status.keyword
    - Order by: Metric:Unique Count of _id
    - Order: Descending
    - Size: 50
    - Custom label: Policy Status

Policy_Deploy_Status_Table

Description: This table displays the policy deployment status and uniquely identified information for the data store, protector, process, platform, node, and so on.

Type: Data Table
Filter: policystatus.type.keyword: POLICY
Configuration:
- Index: pty_insight_analytics*policy_status_dashboard_*
- Metrics:
  - Aggregation: Count
  - Custom label: Metrics Count
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: protector.datastore.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Data Store Name
  - Split rows
    - Aggregation: Terms
    - Field: origin.ip
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Node IP
  - Split rows
    - Aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Host Name
  - Split rows
    - Aggregation: Terms
    - Field: policystatus.status.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Status
  - Split rows
    - Aggregation: Terms
    - Field: origin.time_utc
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Last Seen
  - Split rows
    - Aggregation: Terms
    - Field: process.name.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Process Name
  - Split rows
    - Aggregation: Terms
    - Field: process.id.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Process Id
  - Split rows
    - Aggregation: Terms
    - Field: process.platform.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Platform
  - Split rows
    - Aggregation: Terms
    - Field: process.core_version.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Core Version
  - Split rows
    - Aggregation: Terms
    - Field: process.pcc_version.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: PCC Version
  - Split rows
    - Aggregation: Terms
    - Field: protector.version.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Protector Version
  - Split rows
    - Aggregation: Terms
    - Field: protector.vendor.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Vendor
  - Split rows
    - Aggregation: Terms
    - Field: protector.family.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Family
  - Split rows
    - Aggregation: Terms
    - Field: policystatus.deployment_or_auth_time
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 50
    - Custom label: Deployment Time

Protector Core Version

Description: This pie chart displays the counts of protectors installed for each protector core version.

Type: Pie
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Slice size
  - Aggregation: Unique Count
  - Field: origin.ip
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: protector.core_version.keyword
    - Order by: Metric:Unique count of origin.ip
    - Order: Descending
    - Size: 1000
    - Custom label:CoreVersion

Protector Count

Description: This table displays the number of protector for each family, vendor, and version.

Type: Data Table
Filter: NOT protection.audit_code: is one of 27,28
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Metric:
    - Aggregation: Unique Count
    - Field: origin.ip
    - Custom label: Deployment Count
  - Metric:
    - Aggregation: Sum
    - Field: cnt
    - Custom label: URP
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: protector.family.keyword
    - Order by: Metric: Deployment Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Family
  - Split rows
    - Aggregation: Terms
    - Field: protector.vendor.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Vendor
  - Split rows
    - Aggregation: Terms
    - Field: protector.version.keyword
    - Order by: Metric: Deployment Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Version

Protector Details

Description: This table displays the number of protector for each family, vendor, version, pcc version, and core version.

Type: Data Table
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Metric:
    - Aggregation: Unique Count
    - Field: origin.ip
    - Custom label: Deployment Count
  - Metric:
    - Aggregation: Sum
    - Field: cnt
    - Custom label: URP
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: protector.family.keyword
    - Order by: Metric: Deployment Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Family
  - Split rows
    - Aggregation: Terms
    - Field: protector.vendor.keyword
    - Order by: Metric: Metrics Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Vendor
  - Split rows
    - Aggregation: Terms
    - Field: protector.version.keyword
    - Order by: Metric: Deployment Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Version
  - Split rows
    - Aggregation: Terms
    - Field: protector.pcc_version.keyword
    - Order by: Metric: Deployment Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Pcc Version
  - Split rows
    - Aggregation: Terms
    - Field: protector.core_version.keyword
    - Order by: Metric: Deployment Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Core Version

Protector Families

Description: This pie chart displays the counts of protectors installed for each protector family.

Type: Pie
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Slice size
  - Aggregation: Unique Count
  - Field: origin.ip
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: protector.family.keyword
    - Order by: Metric:Unique count of origin.ip
    - Order: Descending
    - Size: 1000
    - Custom label:Protector Family

Protector List

Description: This table displays details of the protector.

Type: Data Table
Filter: NOT protection.audit_code: is one of 27, 28
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Aggregation: Sum
  - Field: cnt
  - Custom label: URP
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: protector.vendor.keyword
    - Order by: Metric:URP
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Vendor
  - Split rows
    - Aggregation: Terms
    - Field: protector.family.keyword
    - Order by: Metric:URP
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Family
  - Split rows
    - Aggregation: Terms
    - Field: protector.version.keyword
    - Order by: Metric:URP
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Version
  - Split rows
    - Aggregation: Terms
    - Field: origin.ip
    - Order by: Metric:URP
    - Order: Descending
    - Size: 10000
    - Custom label: Protector IP
  - Split rows
    - Aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Metric:URP
    - Order: Descending
    - Size: 10000
    - Custom label: Hostname
  - Split rows
    - Aggregation: Terms
    - Field: protector.core_version.keyword
    - Order by: Metric:URP
    - Order: Descending
    - Size: 10000
    - Custom label: Core Version
  - Split rows
    - Aggregation: Terms
    - Field: protector.pcc_version.keyword
    - Order by: Metric:URP
    - Order: Descending
    - Size: 10000
    - Custom label: Pcc Version

Protector Pcc Version

Description: This pie chart displays the counts of protectors installed for each protector pcc version.

Type: Pie
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Slice size
  - Aggregation: Unique Count
  - Field: origin.ip
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: protector.pcc_version.keyword
    - Order by: Metric:Unique count of origin.ip
    - Order: Descending
    - Size: 999
    - Custom label:PccVersion

Protector Status

Description: This table display protector status information.

Type: Data Table
Configuration:
- Index: pty_insight_analytics*protector_status_dashboard_*
- Metrics:
  - Aggregation: Top Hit
  - Field: origin.time_utc
  - Aggregate with: Concatenate
  - Size: 100
  - Sort on: origin.time_utc
  - Order: Descending
  - Custom label: last seen
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: protector.datastore.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Datastore
  - Split rows
    - Aggregation: Terms
    - Field: origin.ip
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Node IP
  - Split rows
    - Aggregation: Terms
    - Field: origin.hostname.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Hostname
  - Split rows
    - Aggregation: Terms
    - Field: process.platform.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Platform
  - Split rows
    - Aggregation: Terms
    - Field: process.core_version.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Core Version
  - Split rows
    - Aggregation: Terms
    - Field: protector.vendor.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Vendor
  - Split rows
    - Aggregation: Terms
    - Field: protector.family.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Family
  - Split rows
    - Aggregation: Terms
    - Field: protector.version.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Version
  - Split rows
    - Aggregation: Terms
    - Field: protector_status.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Status

Protector Vendor

Description: This pie chart displays the counts of protectors installed for each protector vendor.

Type: Pie
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Slice size
  - Aggregation: Unique Count
  - Field: origin.ip
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: protector.vendor.keyword
    - Order by: Metric:Unique count of origin.ip
    - Order: Descending
    - Size: 1000
    - Custom label:Vendor

Protector Version

Description: This pie chart displays the protector count for each protector version.

Type: Pie
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Slice size
  - Aggregation: Unique Count
  - Field: origin.ip
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: protector.version.keyword
    - Order by: Metric:Unique count of origin.ip
    - Order: Descending
    - Size: 1000
    - Custom label: Version

Security Operation Table

Description: The table displays the number of security operations grouped by data stores, protector vendors, and protector families.

Type: Data Table
Filter: NOT protection.audit_code: is one of 27 , 28
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Aggregation: Sum
  - Field: cnt
  - Custom label: Security Operations Count
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: protection.datastore.keyword
    - Order by: Metric:Security Operation Count
    - Order: Descending
    - Size: 10000
    - Custom label: Data Store Name
  - Split rows
    - Aggregation: Terms
    - Field: protector.family.keyword
    - Order by: Metric:Security Operation Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Family
  - Split rows
    - Aggregation: Terms
    - Field: protector.vendor.keyword
    - Order by: Metric:Security Operation Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Vendor
  - Split rows
    - Aggregation: Terms
    - Field: protector.version.keyword
    - Order by: Metric:Security Operation Count
    - Order: Descending
    - Size: 10000
    - Custom label: Protector Version

Successful Security Operation Values

Description: The visualization displays only successful protect, unprotect, and reprotect operation counts.

Type: Metric
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Aggregation: Sum
  - Field: cnt
  - Custom label: Count
- Buckets:
  - Split group
    - Aggregation: Filters
    - Filter 1-Protect: protection.operation: protect and level: success
    - Filter 2-Unprotect: protection.operation: unprotect and level: success
    - Filter 3-Reprotect: protection.operation: reprotect and level: success

Successful Security Operations

Description: The pie chart displays only successful protect, unprotect, and reprotect operations.

Type: Pie
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Aggregation: Sum
  - Field: cnt
  - Custom label: URP
- Buckets:
  - Split slices
    - Aggregation: Filters
    - Filter 1-Protect: protection.operation: protect and level: Success
    - Filter 2-Unprotect: protection.operation: unprotect and level: Success
    - Filter 3-Reprotect: protection.operation: reprotect and level: Success

Support Logs - Controls

Description: The visualization specifies the filters for the Support Logs data table.

Type: Controls
Configuration:
- Level:
  - Control Label: Level
  - Index Pattern: pty_insight_analytics*troubleshooting_*
  - Field: level.keyword
  - Multiselect: True
  - Dynamic Options: True
- Pod:
  - Control Label: Pod
  - Index Pattern: pty_insight_analytics*troubleshooting_*
  - Field: origin.pod_name.keyword
  - Multiselect: True
  - Dynamic Options: True
- Container:
  - Control Label: Container
  - Index Pattern: pty_insight_analytics*troubleshooting_*
  - Field: origin.container_name.keyword
  - Multiselect: True
  - Dynamic Options: True
- Namespace:
  - Control Label: Namespace
  - Index Pattern: pty_insight_analytics*troubleshooting_*
  - Field: origin.namespace_name.keyword
  - Multiselect: True
  - Dynamic Options: True

Support Logs Data Table

Description: The table displays the filtered data for support logs.

Type: Data Table
Configuration:
- Index: pty_insight_analytics*troubleshooting_*
- Metrics:
  - Aggregation: Unique Count
  - Field: _id
  - Custom label: COUNT
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: origin.time_utc
    - Order by: Alphabetically
    - Order: Descending
    - Size: 200
    - Custom label: ORIGIN TIME
- Buckets:
  - Split rows
    - Aggregation: Terms
    - Field: level.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 200
    - Custom label: LEVEL
  - Split rows
    - Aggregation: Terms
    - Field: additional_info.description.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 200
    - Custom label: DESCRIPTION
  - Split rows
    - Aggregation: Terms
    - Field: origin.pod_name.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 998
    - Custom label: POD NAME
  - Split rows
    - Aggregation: Terms
    - Field: origin.container_name.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 200
    - Custom label: CONTAINER NAME
  - Split rows
    - Aggregation: Terms
    - Field: origin.namespace_name.keyword
    - Order by: Alphabetically
    - Order: Descending
    - Size: 200
    - Custom label: NAMESPACE
  - Split rows
    - Aggregation: Terms
    - Field: logtype.keyword
    - Order by: Metric:COUNT
    - Order: Descending
    - Size: 200
    - Custom label: LOGTYPE
  - Split rows
    - Aggregation: Terms
    - Field: index_time_utc
    - Order by: Metric:COUNT
    - Order: Descending
    - Size: 98
    - Custom label: INDEX TIME
  - Split rows
    - Aggregation: Terms
    - Field: origin.ip
    - Order by: Metric:COUNT
    - Order: Descending
    - Size: 200
    - Custom label: ORIGIN IP
  - Split rows
    - Aggregation: Terms
    - Field: origin.pod_id.keyword
    - Order by: Metric:COUNT
    - Order: Descending
    - Size: 200
    - Custom label: POD ID
  - Split rows
    - Sub Aggregation: Terms
    - Field: _id
    - Order by: Metric:COUNT
    - Order: Descending
    - Size: 200
    - Custom label: DOC ID

Total Security Operation Values

Description: The visualization displays successful and unsuccessful security operation counts.

Type: Metric
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Aggregation: Sum
  - Field: cnt
  - Custom label: Count
- Buckets:
  - Split group
    - Aggregation: Filters
    - Filter 1-Successful: logtype:protection and level: Success and not protection.audit_code: 27
    - Filter 2-Unsuccessful: logtype:protection and not level: Success and not protection.audit_code: 28

Total Security Operations

Description: The pie chart displays successful and unsuccessful security operations.

Type: Pie
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics: Slice size
  - Aggregation: Sum
  - Field: cnt
  - Custom label: URP
- Buckets:
  - Split slices
    - Aggregation: Filters
    - Filter 1-Successful: logtype:protection and level: Success and not protection.audit_code: 27
    - Filter 2-Unsuccessful: logtype:protection and not level: Success and not protection.audit_code: 28

Trusted_App_Status_Chart

Description: The pie chart displays the trusted application deployment status.

Type: Pie
Filter: policystatus.type.keyword: TRUSTED_APP
Configuration:
- Index: pty_insight_analytics*policy_status_dashboard_*
- Metrics:
  - Slice size:
    - Aggregation: Unique Count
    - Field: _id
    - Custom label: Trusted App
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: policystatus.status.keyword
    - Order by: Metric: Trusted App
    - Order: Descending
    - Size: 100
    - Custom label: Trusted App Status

Trusted_App_Status_Table

Description: The trusted application deployment status that is displayed on the dashboard. This table uniquely identifies the data store, protector, process, platform, node, and so on.

Type: Data Table
Filter: policystatus.type.keyword: TRUSTED_APP
Configuration:
- Index: pty_insight_analytics*policy_status_dashboard_*
- Metrics:
  - Aggregation: Count
  - Custom label: Metrics Count
- Buckets: - Split rows - Aggregation: Terms - Field: policystatus.application_name.keyword - Order by: Metric: Metric:Count - Order: Descending - Size: 50 - Custom label: Application Name
  - Split rows - Aggregation: Terms - Field: protector.datastore.keyword - Order by: Metric: Metric:Count - Order: Descending - Size: 50 - Custom label: Data Store Name
    - Split rows
      - Aggregation: Terms
      - Field: origin.ip
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Node IP
    - Split rows
      - Aggregation: Terms
      - Field: origin.hostname.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Host Name
    - Split rows
      - Aggregation: Terms
      - Field: policystatus.status.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Status
    - Split rows
      - Aggregation: Terms
      - Field: origin.time_utc
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Last Seen
    - Split rows
      - Aggregation: Terms
      - Field: process.name.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Process Name
    - Split rows
      - Aggregation: Terms
      - Field: process.id.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Process Id
    - Split rows
      - Aggregation: Terms
      - Field: process.platform.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Platform
    - Split rows
      - Aggregation: Terms
      - Field: process.core_version.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Core Version
    - Split rows
      - Aggregation: Terms
      - Field: process.pcc_version.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: PCC Version
    - Split rows
      - Aggregation: Terms
      - Field: protector.version.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Protector Version
    - Split rows
      - Aggregation: Terms
      - Field: protector.vendor.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Vendor
    - Split rows
      - Aggregation: Terms
      - Field: protector.family.keyword
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Family
    - Split rows
      - Aggregation: Terms
      - Field: policystatus.deployment_or_auth_time
      - Order by: Metric: Metric:Count
      - Order: Descending
      - Size: 50
      - Custom label: Authorize Time

Unsuccessful Security Operation Values

Description: The metric displays unsuccessful security operation counts.

Type: Metric
Filter 1: logtype: Protection
Filter 2: NOT level: success
Filter 3: NOT protection.audit_code: 28
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Aggregation: Sum
  - Field: cnt
  - Custom label: Count
- Buckets: - Split group - Aggregation: Terms - Field: level.keyword - Order by: Metric:Count - Order: Descending - Size: 10000

Unsuccessful Security Operations

Description: The pie chart displays unsuccessful security operations.

Type: Pie
Filter 1: logtype: protection
Filter 2: NOT level: success
Filter 3: NOT protection.audit_code: 28
Configuration:
- Index: pty_insight_analytics*audits_*
- Metrics:
  - Slice size:
    - Aggregation: Sum
    - Field: cnt
    - Custom label: Counts
- Buckets:
  - Split slices
    - Aggregation: Terms
    - Field: level.keyword
    - Order by: Metric: Counts
    - Order: Descending
    - Size: 10000

Feedback

Was this page helpful?

Last modified : April 09, 2026