Configure and Generate a Chart

Chart is a graphical visualization of data. You can view different kinds of charts, including multiple types of plot, line, bar, and area charts.

Any NWDB rule in the Reporting Engine system which is not sorted by none can be used to instantly create a chart. For more information on "How to create an NWDB rule", see Configure a Rule.

The chart interval can be adjusted from the chart definition panel itself. Every time a chart is executed, it stores its result data locally in the Reporting Engine, so that it can be reviewed in either the Dashboard View or Chart View without any performance considerations.

The following is an overview of the entire process of configuring and generating a chart.

netwitness_config_chart_workflow.png

To configure and generate a chart, perform the following:

  1. Configure Reporting Engine
  2. Configure an NWDB rule
  3. Configure a Chart
  4. Schedule a Chart
  5. View a Chart
  6. Test a Chart
  7. Investigate a Chart
  8. Manage a Chart Group and Chart

Configure Reporting Engine

You must configure the Reporting Engine before you can configure and generate a chart. You must also specify the data source in the Reporting Engine from which the data is extracted. For more information on how to configure a Reporting Engine, see "Configure Reporting Engine" topic in Reporting Engine Configuration Guide.

Configure an NWDB Rule

The NetWitness rule which is not sorted by none is used to create a chart. The NetWitness database extracts the meta from the Reporting Engine and provides the meta for rules. These rules are an essential building block in managing a chart.

Note: If the rule contains the lookup_and_add, sum_count, or sum_values rule actions, the associated chart will not contain data. Do not use lookup_and_add function in a rule to create a chart or a report in a chart format as the output of the lookup_and_add function in a rule will not be displayed on the chart and may result in graphical representation of incorrect information. Also, the PDF for that chart created may show an empty chart or incorrect representation of data.

Configure a Chart

You can configure a chart using the NWDB rules.

Schedule a Chart

After a chart is defined with the required components, you can configure its execution properties by scheduling a chart. Here, you can quickly view, add, and edit the schedule details for a chart.

View a Chart

You can view the scheduled charts in the Chart View.

Test a Chart

You can run the test on a chart and view all the chart details based on the selected time range.

Access Control for a Chart

The Reporting Module provides access control at the chart level. Only a user who has the right set of permissions can perform the tasks in Reporting module. The access control is managed by the administrator from the netwitness_adminicon_25x22.png (Admin) > Security > Roles tab.

When you create users and user roles, ensure that the roles that you create for specific tasks have access to all the necessary permissions. This could require permissions at several levels of the role hierarchy.

Charts can be tied to a specific set of user roles so that when a user logs in NetWitness, the charts with the access rights for the specific user role can be viewed. Users that belong to a user role with the 'Read & Write' access permission can define charts. Further, the access can be tightened so that charts are accessed only by those who have the 'Read Only' access.

At the chart level, you can set the following access permissions for the user roles in NetWitness:

  • Read & Write
  • Read Only
  • No Access

To change the access permission for a specific user role, you must set the permission at the chart level. For example, for Administrators to have access to a specific chart, you could set the permission 'Read & Write' in the Charts Permissions dialog.

You can apply read-only permission to rules in the charts by selecting the checkbox.

Two scenarios that describe how to set access control are explained here:

  • Scenario 1: Permissions applied to Chart Group/ Subgroup/ Chart/ Rules based on the user role.
  • Scenario 2: Read-only permission applied to Rules in the Chart.
Role
(Analyst)		 Permissions applied to chart group, subgroup, chart or rules based on the user role Permissions (Read-only) applied to rules in the chart
Group

Read & Write

 Read & Write Read & Write
Subgroup Read Read Read & Write
Chart

Read

 Read Read & Write
Rules Read Read Read

The chart is assigned the role of a Security Analyst and permissions are set to 'Read & Write' charts.

For scenario 1, each of the levels has a permission set based on the user role. For scenario 2, the Read permission is set for the rules except that the permission for the rules cannot be higher than the permission for the charts.

Note: If the permission for the rules is higher than the permission for the chart, the permission is not applied. For example, if you set the permissions for the Report Group as No Access and specify the option Apply Read-only permission to Rules in the Reports, the read-only permission is not set for the rules.

Access Control for a Chart When Multiple Charts are Selected

To change permissions for multiple charts, you must select several charts and set their access permissions using the Charts Permissions panel. The access permission that you choose is applied to all the selected charts.

Access Control for a Chart When Multiple Charts with Several Rules are Selected

​To change access permissions for a specific user role when multiple charts with several rules are selected, select the checkbox in the Charts Permissions panel.

The read-only access permission is applied to all the rules of the selected charts, provided that the permission of the rules are lower than the permission of the charts.

Note: If a user (other than the super user) creates a chart, the super user cannot access that chart.

Access Control for a Chart Group

To change chart group permissions, select a chart group and set the access permissions using the Charts Permissions panel. Before chart group permissions are applied, the default permission set for all the user roles is 'No Access'.

To change the access permission for a specific user role, set the permission at the chart group level. For example, for administrators to have access to all the charts in a Chart Group, set the permission 'Read & Write' in the Charts Group Permissions panel.

You can also apply permissions to subgroups and charts in the group, and apply read-only permission to rules in the charts by selecting the appropriate checkboxes.

Three scenarios that describe how to set access control are explained here:

  • Scenario 1: Permissions applied to chart groups, subgroups, or charts based on user roles.
  • Scenario 2: Permissions applied to subgroups and charts in the group.
  • Scenario 3: Read-only permission applied to rules in the chart.
Role
(Analyst)		 Permissions applied to chart groups, subgroups, or charts based on user roles Permissions applied to subgroups and charts in the group Permissions (Read-only) applied to rules in the chart
Group

Read & Write

 Read & Write Read & Write

Read & Write
Subgroup Read Read Read & Write - Inherited Read & Write
Chart

Read

 Read Read & Write - Inherited

Read & Write
Rules Read Read Read Read

The chart group is assigned the role of a Security Analyst and permissions are set to 'Read & Write'.

For scenario 1, each of the levels will have a permission set depending on the user role.

For scenario 2, the permission at the chart group level will be inherited by the subgroup and by charts in the group.

For scenario 3, the Read permission is set for the rules. However, the permission set for the rules cannot be higher than the permissions set for the chart group.

The following table lists the columns in the Charts Permissions panel:

Column Description
Roles The role of the user logged into the NetWitness UI.
Read & Write The user can access, view, edit, import, export, and delete the chart in the Charts view. The user can also change the permission for the chart.
Read Only The user can only access and view charts on the Charts view.
No Access The user cannot access or view charts for which this permission is set.
netwitness_checkbox_icon_new.png Apply these permissions to existing sub-groups and Charts in this group Select the checkbox to apply the selected permissions to the existing subgroups in the group and charts in the group.

Note: This checkbox is populated only when you set access permissions for a Chart Group.
netwitness_checkbox_icon_new.png Apply these permissions to all new sub-groups and Charts in this group Select the checkbox to apply the selected permissions to the new subgroups in the group and charts in the group.

Note: This checkbox is populated only when you set access permissions for a Chart Group.
netwitness_checkbox_icon_new.png Apply Read-only permission to Rules in the Charts Select the checkbox to automatically apply permissions to the rules in the charts.