Reporting Group

This example will discuss how to combine SEP and DLP data within IT Analytics by leveraging Microsoft Report Builder to create and publish a SQL Server Reporting Services report. For the purposes of this exercise, we will modify an out-of-the-box SEP dashboard to conveniently display DLP information all on one report.

Modifying a Default Dashboard 

1. Within the Symantec Management Platform console, navigate to: Settings > Notification Server > IT Analytics, then click on Reports in the left menu tree.
2. Click the Report Builder tab and then the Launch Report Builder button. 
3. Allow a few minutes for the application to load. Note that depending on which version of SQL Server you have, you may have a different version of Report Builder. This example covers Report Builder 3.0, which comes standard with SQL Server 2008 SP2 or higher. Note that while SQL Server 2005 meets the minimum prerequisites for installation of IT Analytics, it will only include Report Builder 1.0. If possible, Symantec strongly recommends using SQL Server 2008 SP2 or higher to take advantage of new features included in Report Builder 3.0 for a more robust custom report authoring experience. 
4. From the Getting Started screen, select Open to load an existing report.

5. Within the IT Analytics folder on your Report Server, open the Symantec Endpoint Protection Client Dashboard.

6. IMPORTANT: To prevent overwriting the out-of-the-box report with any edits, make sure to save this report with a different name. To clone this report, click the Report Builder icon in the upper left and then click Save As. Give the report an appropriate name, such as SEP and DLP Admin Dashboard.
7. Once the report has been resaved under a different name, click on the pie chart in the lower left corner and press they delete key to remove this chart from the dashboard. Also delete the pie chart in the lower right as well. You should now only have the top to charts on the canvas. This will leave room for the two DLP charts we will add.

8. We will now need to create a dataset for the first chart to be added. A dataset includes the desired fields and values to populate the report. To create a dataset, right-click on the Dataset folder in the Report Data pane on the left and choose Add Dataset.

9. For the first chart in this example, we will pull in a breakdown of the DLP agent version, so rename the new dataset DLPAgent, then select Use a dataset embedded in my report. Under the Data Source dropdown menu, make sure IT Analytics is selected and then click the Query Designer button.

10. Click the cube selector  on the upper left part of the Query Designer.
11. Select DLP Agent Status Cube from the Cube Selection window.

12. In the Metadata pane of the Query Designer window, expand Measures > Agents.

13. Drag the Agents Count measure to the query pane.

14. Expand the DLP Agent dimension and then drag and drop the Agent - Version attribute to the query pane.

15. Click OK in the Query Designer window and the Dataset Properties window to go back to the main report builder.
16. Click on Insert in the report builder menu and select Chart and Chart Wizard.

17. In the New Chart window, select the DLPAgent dataset we previously created and click Next. Note that the other datasets in there are for the other charts on the dashboard, which were already created from the original report.

18. Select Pie under Chart Type and click Next.

19. From Available fields, drag Agent___Version to the Series pane and Agents_Count to the Values pane and click Next.

20. Select Generic under the Styles pane and click Finish.

21. Click the directional arrows icon and drag the chart down to the lower left portion of the canvas, then click on the edges of the chart to resize to similar height and width as the other charts.

22. Right-click on the box around the chart and select Chart Properties. Under General properties, in the Color palette dropdown, select Pastel.

23. Click the Border properties on the left, then choose the Dotted style and Sliver for color, then click the Outline preset. Click OK to close the Chart Properties window.

24. Right-click on the actual pie chart itself and select 3D Effects. In the 3D Options section, make sure the Enable 3D box is checked, then click OK.

25. Right-click on the Chart Title and select Title Properties. Under the Title text section, rename the chart DLP Agent Version and click OK.

26. Right-click on the legend and select Legend Properties. Under the Legend position section, click the radio button at the bottom (6-o’clock) position, then click OK.

27. Highlight the <<Expr>> text at the top of the dashboard and replace it with the new title of: SEP and DLP Admin Dashboard.
28. Preview the report by clicking the Run button in the upper left hand portion of the toolbar.
29. Verify that the pie chart you just added displays as expected.

30. Select the Design button in the toolbar to go back to the Design view.
31. We will now need to create another dataset for the next chart to be added. To create a dataset, right-click on the Dataset folder in the Report Data pane on the left and choose Add Dataset.
32. Rename the new dataset DLPIncidents, then select Use a dataset embedded in my report. Under the Data Source dropdown menu, make sure IT Analytics is selected and then click the Query Designer button.

33. Click the cube selector  on the upper left part of the Query Designer.
34. Select DLP Endpoint Incident Summary Cube from the Cube Selection window.

35. In the Metadata pane of the Query Designer window, expand Measures > Incidents.

36. Drag the Agents Count measure to the query pane.

37. Expand the DLP Endpoint Incident dimension and then drag and drop the Endpoint Incident – User Name attribute to the query pane.

38. Click OK in the Query Designer window and the Dataset Properties window to go back to the main report builder.
39. Click on Insert in the Report Builder toolbar and select Chart and Chart Wizard.
40. In the New Chart window, select the DLPIncidents dataset we previously created and click Next. 

41. Select Pie under Chart Type and click Next.
42. From Available fields, drag Endpoint_Incident___User_Name to the Series pane and Incident_Count to the Values pane and click Next.

43. Select Generic under the Styles pane and click Finish.
44. Click the directional arrows icon and drag the chart down to the lower left portion of the canvas, then click on the edges of the chart to resize to similar height and width as the other charts.

45. Repeat Steps 22 - 26 from above to achieve the same look and feel that matches the other pie charts. Name the new chart Top Users Triggering DLP Incidents.

46. To filter the number of users to just the top 5, right-click on the edge of the chart and go back into Chart Properties, then click on Filters. Click the Add button to add a new filter, then under the Expression dropdown select [Incident_Count]. For the Operator dropdown, select Top N. Finally under the Value text box type 5. Click OK to close the chart properties window.

47. Click the Run button again to view the dashboard with live data.
48. Verify that only 5 values display for the top users pie chart.

49. Go back into Design mode and click the Save button to finalize the dashboard.
50. To link this report into the Symantec Management Platform console open the console then navigate to the Reports > IT Analytics > Reports folder.
51. Right-click on the Dashboards folder and select New > IT Analytics Report.

52. In the Report Type dropdown box, select Dashboard and then in the Report Name dropdown select the SEP and DLP Admin Dashboard report. Then click the Add Report button.

53. You should see a message saying that the report was added successfully.
54. Refresh your browser and expand the Dashboards folder.
55. Locate and select the report you just added and verify it displays as expected.