Endpoint Protection

Hi All,

I'm having problem with my graphical report of the SEP console like the following:





it doesn't represent anything useful and is totally useless, does anyone know how to make the data meaningful or this is just a testing feature only ?

Thanks,

AWT

Are you looking for such an information
Trick to export customized reports from Symantec endpoint Manage

Personally I like monitors--->log than the reports.I can get the logs there I will export it and then import to an excel sheet.It will give a good information after removing unnecessary columns.

Hi,


The reporting and graphs will be useful if there will be data for 2 - 3 months. This will show the history of the risks and what did the SEP product do on the risks.

sorry Paul - IMO, it's still useless, giving no detail, only percentages and pretty pie charts.
Pretty worthless and our management is not impressed.
we have to monthly manually export reports from the logs features meantioned in this thread.
The reports - joke. We don't want percentages, we want NAMES AND NUMBERS.
Who cares if .05% was infected. We want to know if it was 3 or 30. Management doesn't typically know how many computers we have or what groups they are in. But they DO recognize that 15 infected computers is a big number. So, agreeing with the original poster in this topic - the reports page is what it is, worthless and if they want to make it useful, give us the option to CONFIGURE it and choose either raw numbers or percentages.
Skip the pie junk - can't stress enough how worthless that is.

To answer your question, YES, they are totally unusable and useless.

Wow, I thought I'm the only one who don't know what to do about this graphs ?

to bjohn and ShadowsPapa yes, you're right this is why i made this post since i also don't understand of how to interpret those graphs.

I have to agree with you all.  I am not a big fan of the reporting functionality in SEP.  The only time I have found Pie Charts to be useful is if you can drill down into the details.  I really wish Symantec would implement something like that. 

For example, you initially see 2% infected > clicking on that piece of the pie shows 15 machines by name > clicking on a machine shows it was infected with trojanA > clicking on trojanA shows how many machines infected with that particular virus and/or action taken

You guys seem to have the wrong expectation for what the Reporting features are used for... They are not designed for the Network Admins, they are designed for top-level management and persons who aren't intimately involved with the network or it's security.

If you want to get useful/specific data, you get it from Monitors > Logs. That's where the Net Admins and Security Admins live.

Reports are there for your presentations to higher-level management... the guys that don't care what IP address was attacked by Generic.Virus.b. They want a pie chart that shows a big-picture look at how many different threats were detected... or a bar graph that shows which protection technology (that they just spent big bucks purchasing) is catching the most threats.

Use Reports in your PowerPoint presentations and keep Monitors for your day-to-day in the trenches.

ah....

that is why I'm confused why those graphs and reporting is there in the first place, I believe that some of us here also skip and don't even bother to look at the graphs :-)

but thanks Ryan for your clarification.

Hey Ryan it's not MY expectations, it's the MANAGEMENT's expectations!
MANAGEMENT finds them worthless.
WE have to report to MANAGEMENT.
We have to supply MANAGEMENT.
That's why WE say they are worthless because MANAGEMENT tells US they are worthless!!
Sorry, 1 demerit for assuming "it's all us".
Who do you think gives us our marching orders and demands of us BETTER REPORTS ???
Not my choice, dude, I know how to get the info I need from logs.
I'm just passing along what MANAGMENT thinks of the lame reports! LOL   ;-)

@ShadowsPapa yes, you're not alone man, my director and supervisor also said the same thing :-| and I have to manually process the log and present it monthly.

I thought that my system is defective or got problem but it turns out that everyone else is also got the same problem.

let us wait until next version of SEP comes out with better reporting.

Me, too. For infections, software/application control (to show who tried and what we stopped) and device control info (to show who tried and what we stopped)
Not all management is happy with a simple pie chart and a percentage. They want to to know "what's it mean".
And that actually makes me happy! I don't like dumb or uninterested management.
I like those who don't micromanage, but I like those who are also smart enough to know what to ask.

You're right man.

I'm now creating powershell script to automatically resolve those IP address into DNS name, and yeah processing the data from SEP log manually took approx. 1 hour of my time every month for the final report. Otherwise my director wouldn't have a clue about that pie chart :-o)

Someone in marketing has seen one to many movies and also apparently controls the product feature list. I can only guess that they have this image of people using the SEP console with the graph screen up typing furiously on the keyboard and mumbling "enhance"

In 11.0.6000 they eliminated some of the histograms from the reports, that means we can't even tell what the pie graphs represent. I agree that the reporting is lacking.

We need reports of:

1. reoccuring infections of client computers
2. Cross reference to users so we can see it a user is the cause of infection.
3. Detection rates
4. Computers and users that have not been infected
5. Client versions, not graphs but numbers and sortable
6. a report writer that will let us choose what to include

@Gunbuster yes i agree with you too man, i feels like this product is half bake then released to the market because of the competition.

@khaskins82: yes man, that is just what we need as administrators and also can be shown to the management as well.

I have to agree with you all the reporting feature of SEP present information that is of no use to anyone in our company. I have never been asked for a graph report for management in the 2 years we have been running SEP 11.x . Now we have started using the more advanced features of SEP 11.x I have been asked numerous times to give monthly reports on clients and user activity which is too labour intensive in it current form.

In regard to Ryan's (Ryan_Dasso) comment, this is exactly what I was told on the training course almost word for word, you guys (Symantec Employee's) must have a card with that response written on it. :-P

At least we as Admins should be able to schedule the log reports, even this simple feature for me would make a world of difference. Technology is meant to make our lives as admins easier.

Symantec please listen to our feed back at the end of the day we are the day to day users off you application and when it comes time to re asses our security strategic direction we are the ones providing the technical feed back to management on the solutions in the market place. And if we cannot provide the reports our business colleagues require that's a red X against your product.

yes you're right @Jamit: this is ridiculous, i wonder if this graphs can be more meaningful in the next MR7 or SEP 12 ?
or is there any way to send our feedback to the SEP developers ? so that they can listen to us and do something about it.

I agree with the last 3 or 4 comments.............
We know what we need.
We know what OUR managers ask of us, or demand of us, and how intensive it is each month to prepare these reports.
There's no real automation, the home page really is of little value to most of us.
At a glance I can perhaps see if there were new infections, but beyond that? Who needs percentages?
Those sorts of reports and management requests are for TV, movies - I've never seen those things requested in real life.
Things like Dave was reporting in the Chipmunks movie - those charts and graphs - that's not what's really needed. Real management want's more, they want to name names, and want real numbers. The world has changed. Management knows that technology can give them that info, they see details on their iPhone, so they expect details from us.

That's correct mate,

I've already posted an idea thread in the "Ideas" forum: https://www-secure.symantec.com/connect/idea/sep-reporting-feature-needs-be-working-properly

let's hope someone pick that up or at least becoming one of the most popular feature that will be fixed in the next SEP release.

fingers crossed.

I agree that the reports are essentially useless. Especially the default reports that appear under the Summary tab of the Monitors area.

However it can get worse...

The SQL queries that power the Summary tab's pie charts are rather inefficient. So in our case, with over one hundred groups, hundreds of limited administrators, and tens of thousands of clients, occassionally we've had the Summary tab refuse to load. If that happens, you can't even get to the Logs, Command Status, or Notifications tabs. At least not from the SEPM Console. When this happens, I have to instead log in to the reporting web site directly and hope I don't accidentally click on the Summary tab there.

In my opinion, they should completely get rid of the Summary information. Or at least let us choose whether it's enabled or disabled. Because personally, if I want to see a pretty pie chart, I can manually run a report or schedule one to run automatically.

The summary tab of the logs should not be the default.
I agree, and we have only aboutr 400 computers, a half  dozen or so admins, and a single site. It can really hit the SQL server hard, and if that page doesn't load quickly, you can't move on to the logs tab you REALLY want.
I'd totally redesign the interface and give some configuration options...

J.Bonner you have hit the nail on the head there 'Summary tab'. I have found that if I don't allow it to load fully I cannot open the logs tab. With nearly 10000 clients this takes a couple on minutes time I could be using doing something else.

you guys are right, now the weekly SEP report that is sent to my inbox is always a blank one:

Sadly I must admit that I'm on the same boat with you guys, hoping that i could found some solutions here but then i found this thread (-_-)"

Oh well, looking for ward for the next update / release of SEP then.