20-25
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 20 Queries and Reports
Reports
Unlike the Total View, the Peak View does not focus on the overall top occurring results, instead it
identifies a high volume of traffic over a short time period. Its purpose is to detect temporary bursts of
traffic on your network that overshadow normal traffic usage. These bursts identify possible issues, such
as worm outbreaks.
•
Recent View
. This view is similar to Total View; however, it identifies the top
N
result types that
occurred within the past hour. It then plots all occurrences of those result types over the selected
time period.
•
CSV
. Generates the Total View but presents the report in the CSV format for processing by another
tool or script. This option is intended for use with e-mail notifications where post-processing is
required.
Creating a Report
You can create a report through the
Query
page, or you can create a report from scratch on the
Reports
page. These instructions detail creating a report from the
Reports
page, but are applicable to editing
reports and to creating reports from the
Query
page.
To Create a New Report
Step 1
On the Reports page, click the
Add
button.
Step 2
In the
Report Name
and
Report Description
fields, enter a report name and description. Click the
Next
button.
Step 3
Select the schedule parameters for the report.
Step 4
Select a View Type for the report. You can receive these reports in your email or view them in the UI.
Your choices are:
Total View
,
Peak View
,
Recent View
, and
CSV
(see
Report Type Views: Total vs.
Peak vs. Recent, page 20-24
). Click the
Next
button.
Step 5
Select users in the Recipients Available field by expanding the user groups, clicking users or user
groups, and clicking the
Add
button. See
User Management, page 23-8
for more information.
Step 6
Repeat
Step 5
for other users. Click the
Next
button.
Step 7
Build or modify the query. To edit the query time range, either click the Report type link or click the
Edit
button. See
Result Format, page 20-5
for information on query parameters; see
Query Criteria, page
20-10
for more information on building queries. Click
Apply
to save your changes; click
Next
when the
query is complete.
Step 8
Click
Submit
to save your report.
Working With Existing Reports
To View a Report
Step 1
Click the radio button next to the report.
Step 2
From the drop-down list on the bottom of the page, select either:
–
View HTML
: to view the report as an HTML file.
–
View CSV
: to view the report as a CSV file.
