Displaying SEP and DLP Data on the Same Dashboard in IT Analytics

Created: 22 May 2013 • Updated: 22 Nov 2013
dprager's picture
Login to vote
+16 16 Votes

This example will discuss how to combine SEP and DLP data within IT Analytics by leveraging Microsoft Report Builder to create and publish a SQL Server Reporting Services report. For the purposes of this exercise, we will modify an out-of-the-box SEP dashboard to conveniently display DLP information all on one report.

Modifying a Default Dashboard 

  1. Within the Symantec Management Platform console, navigate to: Settings > Notification Server > IT Analytics, then click on Reports in the left menu tree.
  2. Click the Report Builder tab and then the Launch Report Builder button. 
  3. Allow a few minutes for the application to load. Note that depending on which version of SQL Server you have, you may have a different version of Report Builder. This example covers Report Builder 3.0, which comes standard with SQL Server 2008 SP2 or higher. Note that while SQL Server 2005 meets the minimum prerequisites for installation of IT Analytics, it will only include Report Builder 1.0. If possible, Symantec strongly recommends using SQL Server 2008 SP2 or higher to take advantage of new features included in Report Builder 3.0 for a more robust custom report authoring experience. 
  4. From the Getting Started screen, select Open to load an existing report.

View Inline Image

  1. Within the IT Analytics folder on your Report Server, open the Symantec Endpoint Protection Client Dashboard.

View Inline Image

  1. IMPORTANT: To prevent overwriting the out-of-the-box report with any edits, make sure to save this report with a different name. To clone this report, click the Report Builder icon in the upper left and then click Save As. Give the report an appropriate name, such as SEP and DLP Admin Dashboard.
  2. Once the report has been resaved under a different name, click on the pie chart in the lower left corner and press they delete key to remove this chart from the dashboard. Also delete the pie chart in the lower right as well. You should now only have the top to charts on the canvas. This will leave room for the two DLP charts we will add.

View Inline Image

  1. We will now need to create a dataset for the first chart to be added. A dataset includes the desired fields and values to populate the report. To create a dataset, right-click on the Dataset folder in the Report Data pane on the left and choose Add Dataset.

View Inline Image

  1. For the first chart in this example, we will pull in a breakdown of the DLP agent version, so rename the new dataset DLPAgent, then select Use a dataset embedded in my report. Under the Data Source dropdown menu, make sure IT Analytics is selected and then click the Query Designer button.

View Inline Image

  1. Click the cube selector View Inline Image on the upper left part of the Query Designer.
  2. Select DLP Agent Status Cube from the Cube Selection window.

View Inline Image

  1. In the Metadata pane of the Query Designer window, expand Measures > Agents.

View Inline Image

  1. Drag the Agents Count measure to the query pane.

View Inline Image

  1. Expand the DLP Agent dimension and then drag and drop the Agent - Version attribute to the query pane.

View Inline Image

  1. Click OK in the Query Designer window and the Dataset Properties window to go back to the main report builder.
  2. Click on Insert in the report builder menu and select Chart and Chart Wizard.

View Inline Image

  1. In the New Chart window, select the DLPAgent dataset we previously created and click Next. Note that the other datasets in there are for the other charts on the dashboard, which were already created from the original report.

View Inline Image

  1. Select Pie under Chart Type and click Next.

View Inline Image

  1. From Available fields, drag Agent___Version to the Series pane and Agents_Count to the Values pane and click Next.

View Inline Image

  1. Select Generic under the Styles pane and click Finish.

View Inline Image

  1. Click the directional arrows icon and drag the chart down to the lower left portion of the canvas, then click on the edges of the chart to resize to similar height and width as the other charts.

View Inline Image

  1. Right-click on the box around the chart and select Chart Properties. Under General properties, in the Color palette dropdown, select Pastel.

View Inline Image

  1. Click the Border properties on the left, then choose the Dotted style and Sliver for color, then click the Outline preset. Click OK to close the Chart Properties window.

View Inline Image

  1. Right-click on the actual pie chart itself and select 3D Effects. In the 3D Options section, make sure the Enable 3D box is checked, then click OK.

View Inline Image

  1. Right-click on the Chart Title and select Title Properties. Under the Title text section, rename the chart DLP Agent Version and click OK.

View Inline Image

  1. Right-click on the legend and select Legend Properties. Under the Legend position section, click the radio button at the bottom (6-o’clock) position, then click OK.

View Inline Image

  1. Highlight the <<Expr>> text at the top of the dashboard and replace it with the new title of: SEP and DLP Admin Dashboard.
  2. Preview the report by clicking the Run button in the upper left hand portion of the toolbar.
  3. Verify that the pie chart you just added displays as expected.

View Inline Image

  1. Select the Design button in the toolbar to go back to the Design view.
  2. We will now need to create another dataset for the next chart to be added. To create a dataset, right-click on the Dataset folder in the Report Data pane on the left and choose Add Dataset.
  3. Rename the new dataset DLPIncidents, then select Use a dataset embedded in my report. Under the Data Source dropdown menu, make sure IT Analytics is selected and then click the Query Designer button.

View Inline Image

  1. Click the cube selector View Inline Image on the upper left part of the Query Designer.
  2. Select DLP Endpoint Incident Summary Cube from the Cube Selection window.

View Inline Image

  1. In the Metadata pane of the Query Designer window, expand Measures > Incidents.

View Inline Image

  1. Drag the Agents Count measure to the query pane.

View Inline Image

  1. Expand the DLP Endpoint Incident dimension and then drag and drop the Endpoint Incident – User Name attribute to the query pane.

View Inline Image

  1. Click OK in the Query Designer window and the Dataset Properties window to go back to the main report builder.
  2. Click on Insert in the Report Builder toolbar and select Chart and Chart Wizard.
  3. In the New Chart window, select the DLPIncidents dataset we previously created and click Next

View Inline Image

  1. Select Pie under Chart Type and click Next.
  2. From Available fields, drag Endpoint_Incident___User_Name to the Series pane and Incident_Count to the Values pane and click Next.

View Inline Image

  1. Select Generic under the Styles pane and click Finish.
  2. Click the directional arrows icon and drag the chart down to the lower left portion of the canvas, then click on the edges of the chart to resize to similar height and width as the other charts.

View Inline Image

  1. Repeat Steps 22 - 26 from above to achieve the same look and feel that matches the other pie charts. Name the new chart Top Users Triggering DLP Incidents.

View Inline Image

  1. To filter the number of users to just the top 5, right-click on the edge of the chart and go back into Chart Properties, then click on Filters. Click the Add button to add a new filter, then under the Expression dropdown select [Incident_Count]. For the Operator dropdown, select Top N. Finally under the Value text box type 5. Click OK to close the chart properties window.

View Inline Image

  1. Click the Run button again to view the dashboard with live data.
  2. Verify that only 5 values display for the top users pie chart.

View Inline Image

  1. Go back into Design mode and click the Save button to finalize the dashboard.
  2. To link this report into the Symantec Management Platform console open the console then navigate to the Reports > IT Analytics > Reports folder.
  3. Right-click on the Dashboards folder and select New > IT Analytics Report.

View Inline Image

  1. In the Report Type dropdown box, select Dashboard and then in the Report Name dropdown select the SEP and DLP Admin Dashboard report. Then click the Add Report button.

View Inline Image

  1. You should see a message saying that the report was added successfully.
  2. Refresh your browser and expand the Dashboards folder.
  3. Locate and select the report you just added and verify it displays as expected.

View Inline Image

Filed Under

Tags:

Comments

09
Jun
2013

Useful guide!

Useful guide!

Sachin Sawant's picture
Sachin Sawant
Partner
Accredited
12
Jun
2013

It’s very help full

It’s very help full

yang_zhang's picture
yang_zhang
Symantec Employee
Accredited
Certified
12
Jul
2013

Good and useful.

Good and useful.

If a forum post solves your problem, please flag it as a solution. If you like an article, blog post or download vote it up.