Advanced Reporting in IT Analytics Data Loss Prevention Content Pack
This example includes building a dashboard utilizing IT Analytics cubes in Microsoft Report Builder. Report Builder is a component included with SQL Server Reporting Services that allows ad-hoc reporting functionality, enabling end users to build their own reports and charts. Report Builder uses wizard driven steps to easily connect to data sources and locate the desired fields for creating a report. Users can then publish these reports back into the Symantec Management Platform console for viewing, as well as other venues like SharePoint and Reporting Services. For more information on using Report Builder, please see the Microsoft website.
NOTE: Although the output produced by Report Builder is integrated with IT Analytics, the tools and subsequent query language behind it are separate Microsoft entities and are thereby outside the default capabilities of the IT Analytics product itself.
Creating a Custom Dashboard
In this exercise we will create a custom dashboard that displays the number incidents by type and severity.
- Within the Symantec Management Platform console, navigate to: Settings > Notification Server > IT Analytics, then click on Reports in the left menu tree, then click the Report Builder tab and then the Launch Report Builder button.
- Allow a few minutes for the application to load. Note that depending on which version of SQL Server you have, you may have a different version of Report Builder. This example covers Report Builder 3.0, which comes standard with SQL Server 2008 SP2 or higher. Note that while SQL Server 2005 meets the minimum prerequisites for installation of IT Analytics, it will only include Report Builder 1.0. If possible, Symantec strongly recommends using SQL Server 2008 SP2 or higher to take advantage of new features included in Report Builder 3.0 for a more robust custom report authoring experience.
- From the Getting Started screen, select Blank Report, then click on the report body and in the Properties pane, expand Size and set the Width to 11in and Height to 8.5in.
- Click on the text ‘Click to add title’ and type in Admin Dashboard.
- In the Report Data pane, right-click on Data Sources and select Add Data Source.
- Enter ITAnalytics as the data source name and select the ‘Use a shared connection in my report’ radio button.
- Click the Browse button and navigate to the IT Analytics directory, then select the ITAnalytics data source.
- Click the Test Connection button and verify the data source has a valid connection.
- Click OK to close the window and complete the creation of the data source.
- In the Report Data pane on the left, right-click on Datasets and select Add Dataset.
- In the Dataset Properties window, rename this as ‘AdminEvents’ then select the ‘Use a dataset embedded in my report’ radio button, click on the dropdown for Data source and select ITAnalytics.
- Click the Query Designer button in the Dataset Properties window.
- Ensure that the DLP Administrative Events cube is selected in the cube selector window (upper left).
- In the Metadata pane of the Query Designer window, expand Measures > Administrative Events, then drag the Administrative Events Count measure to the query pane.
- Expand DLP Administrative Event dimension and drag and drop the Event - Username attribute to the query pane.
- Expand DLP Administrative Event Date dimension and drag and drop the Administrative Event Date - Quarter attribute to the query pane.
- From the DLP Administrative Event dimension drag and drop the Event – Entity attribute to the filter pane, located just above the query section.
- Ensure the Parameter checkbox is selected and in the Filter Expression dropdown select ‘Incident’ and click OK. This will change the result set in the query window.
- From the DLP Administrative Event dimension drag and drop the Event – Action attribute to the filter pane, just below the filter you previously added.
- DO NOT select the Parameter checkbox for this filter and in the Filter Expression dropdown select ‘View, Status Changed and Delete’ and click OK.
- Click OK in the Query Designer window and the Dataset Properties window to go back to the main report builder.
- Click on Insert in the report builder menu and select Chart and Chart Wizard.
- In the New Chart window, select AdminEvents and click Next.
- Select Pie under Chart Type and click Next.
- From Available fields, drag Administrative_Events_Count to the Values pane and Administrative_Event_Date___Quarter and Event___Username to the Series pane and click Next.
- Select Generic under the Styles pane and click Finish.
- Drag the width of the chart space out to the right and then right-click on Chart Title and select Title Properties.
- Change Title text to Incident Views by User or something appropriate and click OK.
- Right-click on the pie chart and select 3D Effects.
- Ensure that the Enable 3D checkbox is selected.
- Right-click on the pie chart again and select Show Data Labels.
- Preview the report by clicking the Run report button in the toolbar and make any other adjustments.
- After selecting the View Report button you will be presented with a preview of your report with realtime data.
- Select the Design button on the toolbar to return to the Design view.
- Click the View Inline Image icon in the Report Builder toolbar to save this report to the Reporting Services IT Analytics folder and name it ‘DLP Admin Dashboard’.
- To link this report into the Altiris Console Open the Altiris Console from the shortcut on your desktop then navigate to the Reports > IT Analytics > Dashboards folder.
- Right-click on the Dashboards folder and select New > IT Analytics Report.
- In the Report Type dropdown box, select Dashboard, ensure the IT Analytics folder is selected and then locate and select the report you just saved. Make the Parameter Area Initially Visible and click the Add Report button.
- Wait to see a message that your report was added successfully, then close the pop up window.
- Refresh your browser and expand the Dashboards folder.
- Locate and select the report you just added.