Viewing Charts

After you load a dashboard, you can view the charts in that dashboard.

Elements in a Chart

Each chart includes the following elements:

1. Type of entity represented in the chart. Choices are:

   • Asset. An entity that stores, transmits, or processes data. Assets include laptops, workstations, servers, virtual machines, cloud instances, and docker containers. Lucidum uses connectors to ingest data from assets.

   • User. An entity that uses authentication and is associated with assets. Lucidum uses connectors (for example, for Microsoft Active Directory, Okta, cloud IAM account, HR software) to ingest data about users. Lucidum uses AI algorithms to de-duplicate users and align users with assets.

   • Asset-IP Mapping. Output from Lucidum AI algorithms that maps each asset to its IP address.

   • User-IP Mapping. Output from Lucidum AI algorithms that maps each user to its associated IP addresses.

2. The Chart Title for the chart. The data in the chart is defined by the query and the Summary for the chart.

3. Clone. Allows you to copy the chart to an existing dashboard.

4. Query Result. Displays a table populated with the results of the query for the chart. You can also click through to view additional details about the data for each chart.

5. Edit. Displays the Edit Chart dialog, where you can edit the query, Chart Title, Chart Type, Subtitle, and X Axis Title for the chart. This option appears only for dashboards that you have created or have admin privileges for.

6. Delete. Removes the chart from the current dashboard. This option appears only for dashboards that you have created or have admin privileges for.

Drilling Down

You can drill down into a chart and view more details about the data.

For example, the bar graph above includes the following:

• Query is for entity type Asset

• Query is for the Current time range. By default, this means the present day through 7 days old.

• Query is:

  • Data Sources not match sepm_protection OR Data Sources not match sentinelone_agent

  • This tells Lucidum to search the asset table the includes current data. And to look for assets that don’t use Symantec Endpoint Protection or SentinelOne.

• Summary is:

  • count Lucidum Asset Nane by Department

  • order by Lucidum Asset Name by Description

  • This tells Lucidum to create graph where assets are sorted by department. And the graph is organized by Lucidum asset name, instead of alphabetically by department.

Using the chart above, if we click on the bar for IT, the chart looks like this:

• Notice that the query (Filter Asset/Current by) now includes a new filter:

  • Department == IT

• The Summary is unchanged.

• The graph displays the number of assets in the IT department that do not use Symantec Endpoint Protection or SentinelOne.

• If you have permission to edit this dashboard, you can click Save > Update chart to update the existing chart with this new query.

• If you have permission to edit this dashboard, you can also click Save > Save as new chart to save this new query as a new chart. However, you must supply a new name in the Chart Title field

Query Result

The Query Result icon opens the Query Result page. The Query Result page displays a table populated with the results of the query for the chart. You can also click through to view additional details about the data for each chart.

Using our example chart, the query includes:

• Query is for entity type Asset

• Query is for the Current time range. By default, this means the present day through 7 days old.

• Query is:

  • Data Sources not match sepm_protection OR Data Sources not match sentinelone_agent

• Therefore, when Lucidum executes the query, the results are a list of assets from the current time period that don’t use Symantec Endpoint Protection or SentinelOne.

If we click on the Query Result icon, we see:

• The Query Result page displays a list of assets that don’t use Symantec Endpoint Protection or SentinelOne..

• You can sort the page by the column headings.

• To see additional details about an asset, click on the > icon at the end of each row.

Details page

When we go to the row for asset I-2ETGBC4FWF2C9T1JQ and click on click on the > icon, we see the following:

Notice there are two tabs: Data Source and Lucidum Data Group.

• The Data Source tab display allows you to see all the data sources from which Lucidum ingested data about the asset. You can select a Data Source to see which raw data was provided by that data source.

  • For our example chart, we selected Tenable_Scan. You can view the data about this asset that Lucidum ingested from Tenable.

• The Lucidum Data Group tab displays all the data that Lucidum stores for this asset. Lucidum ingests data from multiple data sources and uses machine learning to deduplicate and triangulate data for each asset and normalize that data.
  

  

  • For our example chart, from the Details page we selected the Lucidum Data Group tab and then the Asset field. We can then see what kind of information Lucidum stores under the Asset label.