In this video, we'll get to take a big fish look at the wonderful world of
reports on the 40 Analyzer.
So if somebody came up to us and said, "Okay, what is the big deal out reports
on the 40 Analyzer?"
To summarize it, we could say it's a high-level summary of what's happening in
our environment
based on all the information that the 40 Analyzer has. Now, as far as a high-
level summary, to get
that is pulling that information from the SQL database that the 40 Analyzer
uses once it gets
all the log-in of any information from all the devices. And then regarding what
kind of reports,
there are a whole bunch of predefined reports, and we can also create custom WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there are a whole bunch of predefined reports, and we can also create custom
reports. And if we
want to use custom reports, it's also important to be aware of some of the
detailed ingredients that
go into a report. So here are some of the elements. So one of the components
that can go into our
reports would be a chart. Now, the chart, there's lots of different types of
charts. We get a chart
that's a table of data, or it could be a bar chart, or a pie chart, or a line
chart, or a donut chart.
There's also a radar chart. And the idea behind the chart is that what is the
best way to represent
the information that we're presenting as part of the reports. We could have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the information that we're presenting as part of the reports. We could have
various different
types of charts included in a report. So that's one of our ingredients is the
chart we're going to use.
Another element that we can use as part of our reports is called a template.
And the benefit of
a template, I think of it like a cookie cutter. And with a cookie cutter, every
time you use it,
you're going to get the same shape, for example, assuming you have the right
dough in place. And
you use the cookie cutter, you get the same exact type of look and feel every
time. So if we have
all of our details, for example, we have charts set up, and we have the layout
organized,
we can include that as part of a template, and then we can just use that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can include that as part of a template, and then we can just use that
template over and over again
anytime we want to report that has certain charts or certain elements contained
in it.
So in addition to having a template that includes charts based on how we want
that
report to look, that template is also going to include the layout information,
for example,
which chart goes first, which chart goes second, which text goes where, and we
'd also include things
like the colors that were being used, or if there's branding involved in the
report that you want
as part of the template representing your company, that could be included as
part of the template.
And one other element here would be, for example, the font that's going to be
used that'd be part WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
used that'd be part
of the template. And I have a little arrow here that the charts can be included
as part
of the template. So if we choose a template that's currently using one or more
of these charts,
it would be included as part of the final report. Now another question is, okay
, what exact data
we're playing from as we, you know, use the charts and templates and build
these reports. Well,
we can control what data is being pulled by another element called a dataset.
And when you see the
word dataset, think of a SQL query. And let's break that down for a moment.
Many decades ago, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Many decades ago,
when I was first introduced to structured query language, or as its friends
call it SQL, I learned
back in the day, the commands we would use to query or make requests from a SQL
database. And
again, that SQL database is being maintained over here at the 40 analyzer,
based on logging events
and other information it receives from the devices. And it inserts that into a
SQL database. So the
dataset represents the actual SQL commands that we would use to request certain
information from
that database. And here's a high level example. Let's imagine that we want to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that database. And here's a high level example. Let's imagine that we want to
pull from the SQL
database, we want to pull information from the log files. So we'll say from log
files. And inside
the SQL statement, we'd actually put a dollar sign in front of that to
represent the log files
that we're going to pull from. And then we could also limit that by saying we
only want to pull
the category description, for example, proxy avoidance, or, you know, some
other category that
we're looking for. So I'll put XYZ as an example for the category description,
assuming there was a
category for websites of XYZ. Then as part of our dataset, we also have the
options of specifying WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
options of specifying
how we want to group that information and how we want to order that information
. So regarding a
report that we want to actually be able to use, that report could be based on a
template that's
going to specify, for example, what charts based on the charts we have
available. And that report
is also going to include the dataset specifying what to pull, what information
to query from the
SQL database. And then when we run that report, it's like an orchestra, where
we have the dataset
querying and pulling the data, we have the template with the respective charts
and the ordering and
the layout and so forth, that's controlling how that information is going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the layout and so forth, that's controlling how that information is going to
look in the charts,
in the tables and so forth, in the final report. There's also one other
component here that's very
closely related to datasets, and then it's called a macro. And think of a macro
like a predefined
itty bitty little dataset identifying what information you want to pull. And
for most of the reporting
that we're going to be doing with the 40 analyzer, even though we can create
custom charts and we
can create custom templates and we can create custom reports, and we can create
custom datasets
and macros, most of the time, because there's so many prebuilt and ready to go, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and macros, most of the time, because there's so many prebuilt and ready to go,
datasets, templates
and charts, most of the time we just run a report that's already been pred
efined by FordNet. However,
on the other side of that coin, if we need to customize something, we also have
the ability to
customize it as well. So let me clean this up a little bit and let's chat a
little bit further
about reports in general. A few things we want to consider regarding reports.
Number one,
who is the audience for that report? For example, is it the engineering team,
is it the security operations center, is it for an executive? So we want to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is it the security operations center, is it for an executive? So we want to
consider the audience
and make sure we're giving them the right reports based on what they need to
see. And that would
also include considering the purpose of that report, because if we know what
the intent is,
that's also going to help us in choosing the correct report or creating the
correct report.
And another factor that ties into all this is what level of detail do we want
to include.
For example, an executive probably doesn't need a report with the individual
MAC address, for example,
of a device on the network that's having a problem. However, that same
information,
that MAC address might be really important for somebody who is, you know, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that MAC address might be really important for somebody who is, you know,
working on an incident
and troubleshooting and trying to find out or get to the root of a problem. So
again, consider the
audience regarding reports. And then one other consideration is the format. So
we can have
reports that are HTML based or PDF based, there's other options as well. So you
just want to consider
how the customer or the end user or the end person who's going to look at the
report,
how they're going to ingest that or consume that and make it easy for them to
get to.
And one other cool thing about reports is that if we have a report that we want
run, for example,
every week or every day, we can also automate that. And that way those reports WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
every week or every day, we can also automate that. And that way those reports
can be generated,
we can have notifications sent out as well. And that way those reports are
sitting there
where we store them whenever they're needed. Sorry, help put automate slash
schedule reports.
So with this in mind, in the next video, let's take a look at the 40 analyzer
and some of the
pre built ready to rock reports that Fortinet has provided for us on the 40
analyzer. So we'll do
that in the next video. I'll see you there in just a moment.