Platform Analytics Dashboard

[Tarbash2]

Hello All, 

I would like to have the ability to filter out the data by type of system (Windows Server, Computer, etc.). When you explore a CI, it is in a field called "class". What I like to to do is provide a filter that has all the possible values for the field 'class' so the data can be filtered based on the 'class' value. The table most of the data comes from is a table in the Vulnerability Response module called 'Vulnerable Item' table. The variable 'configuration item' looks promising but among the many fields it has, I am not sure which field needs to be selected in order to achieve what I am trying to do. Any help is greatly appreciated.

[Simon Hendery]

Hi @Tarbash2 

I'm not clear exactly what the data set is you're working with. You say 'most' of it comes from the Vulnerable Item table ... where does the rest come from?

Regardless, I don't think filtering on the Class field in the Vulnerable Item table will give you what you're looking for.

That's because the Vulnerable Item table (sn_vul_vulnerable_item) stores records that represent the relationship between a specific CI and a specific vulnerability entry (from the NVD feed or other source).

Essentially, each vulnerable item is a unique instance of "this vulnerability affects this asset" and I don't think that's what you're looking for.

Could you explain more about what you're trying to achieve?

You may possibly be better to filter the CI table (cmdb_ci) or one of its child tables (e.g., cmdb_ci_computer, cmdb_ci_server, etc.).

[Tarbash2]

Hello @Simon Hendery 

Thank you for taking the time to help.

All the data comes from "Vulnerable Item" table which is part of the Vulnerability Response application. I have created a dashboard using Platform Analytics plugin. All the data that is being depicted onto this dashboard and filtered comes from the "Vulnerable Item" table. The "Data Source" for all the Data  Visualization Elements is the "Vulnerable Item" table. 

Since every CI has a "class" attribute, I would like to add a filter where one could filter the data presented in the dashboard for the "class" attribute they are interested in. For example, someone might be interested to know the data for a CI with a class attribute of 'Windows Server' and another person might be interested in knowing the data that's depicted on the dashboard but for the CIs with a class attribute of 'Computer'.

I don't think I can use a different data source other than "Vulnerable Item" table if I want the filter to actually work.

I hope this helps clarify what I am trying to do as well as answer the questions you raised.

TB