Viewing Master Tables

After ingesting raw data from multiple data sources, Lucidum deduplicates, triangulates, and aggregates the data to create enriched records for each asset and user. Lucidum then stores the enriched data in the Lucidum master database tables.

Lucidum includes the following master tables:

• Assets

• Users

• Vulnerabilities

The master tables store data that has been transformed by Lucidum.

Use Cases

You might find it helpful to use the master tables to:

• get an overview of the data available for queries, reports, and dashboards

• explore how Lucidum enriches the data from your environment

• use filters to build queries instead of the query builder

• make sure that data you need is in the Lucidum database

• determine if you need to configure additional connectors to get additional data

Page Elements

The pages for Assets, Users, and Vulnerabilities include the following elements:

1. Sort by. The up arrow and down arrow icons allow you to sort the table, by the selected column. Up arrow sorts in ascending order (smallest to largest or a-z). Down arrow sorts in descending order (largest to smallest or z-a). You can sort the table only by a single column.

2. Filter. The filter icon allows you to sort the table by a selected value in the selected column. You can apply multiple filters to a single table. The filters are applied in the order you define them. For example, if you filter by Data Category and then Lucidum User Name, Lucidum will first display a list of entries that match the selected Data Category. To those entries that match the first filter, Lucidum will filter by Lucidum User Name.

3. Search. The search field searches the database and presents all the matching records as cards in the Table Search Results page.

4. Query Builder. In the Assets page, Users page, or Vulnerabilities page, if you apply one or more filters to the table and then click Query Builder, the New Query page appears, with the filters converted to query parameters. You can then edit the query or save it.

5. Edit Column. You can add one or more additional columns to the table or remove a column from this table. When you click Edit Column, the Edit Columns modal appears, where you can select and deselect from the list of all the possible columns for the table.

6. … menu. This button provides the following additional actions:

   • Save Query. Saves the current filters as a query for later use.

   • Add Dynamic Field. A dynamic field is a saved query that can be used as a single field and nested inside other queries. For example, you could create a query that searches for all assets that are workstations, are managed in Active Directory, have endpoint protection installed, and the hard drive is encrypted. You could save this query as a dynamic field called secure_workstation. You could then use this field as you would any other field when building a query

   • Export Result. You can export the table, saving the filters and sorting, to a .CSV file.

7. > icon. Leads to the Details page, where you can view all the data, both Lucidum data and raw data, for a single entry in the table.

Using the Filter Icon

The filter icon allows you to find exactly the assets, users, or vulnerabilities from the list of all assets, users, or vulnerabilities. You can then save the filter as a saved query, as a dynamic field, or as a .CSV file.

To use the filter icon:

1. Log in to Lucidum. Select either Asset, User, or Vulnerability from the left navigation bar. In this example, we use the Asset page.

   

2. Click on the filter icon next to the column name you want to use as the first filter. In our example, we clicked on the filter icon next to Data Category.

3. Click on the empty field and select from a list of values for that column. In our example, we selected Finance. Click Apply.

4. The Asset page now displays only assets with a value of Finance in the Data Category column.

   

5. To further filter this list, we can choose another column. In this example, we can filter by Lucidum User Name. We selected the use name AHUNT.

   

6. After clicking Apply, we now have a list of two assets.

   

7. We can now save this filter as a query or export these results to a .CSV file.

Saving Filters as Queries

After performing the steps in the section on Using the Filter Icon, we see a filtered list of assets like this:

If we click the Query Builder button, we see the New Query page, populated with the selected filters:

• You can edit the query. For details on creating and editing queries, see Creating a Query

• You can save the query for use in a dashboard. For details on saved queries, see Using Saved Queries and Query History

• You can save the query as a dynamic field. For details on dynamic fields, see Creating Dynamic Fields

Assets

To view data that Lucidum has ingested about assets:

1. Click the Asset icon in the left navbar.

2. The Asset page appears. In this page, you can view and sort data about assets.

• To view one or more additional columns in this page, or to remove a default column from this page, click on the Edit Column button.

• To sort by a column value, click the up and down arrows next to the column name.

• To filter by column value, click the funnel icon next to the column name. You can filter by more than one column. The first column you use as a filter will be the primary filter. You can further filter by additional columns.

• After creating a filter, you can click the Query Builder button to see a query that reflects the currently applied filters.

• After creating a filter, you can save the filter as a query or save the filtered results as a .CSV file.

Users

To view data that Lucidum has ingested about users:

1. Click the User icon in the left navbar.

2. The User page appears. In this page, you can view and sort data about users.

• To view one or more additional columns in this page, or to remove a default column from this page, click on the Edit Column button.

• To sort by a column value, click the up and down arrows next to the column name.

• To filter by column value, click the funnel icon next to the column name. You can filter by more than one column. The first column you use as a filter will be the primary filter. You can further filter by additional columns.

• After creating a filter, you can click the Query Builder button to see a query that reflects the currently applied filters.

• After creating a filter, you can save the filter as a query or save the filtered results as a .CSV file.

Vulnerabilities

To view data that Lucidum has ingested about vulnerabilities:

1. Click the Vulnerability icon in the left navbar.

2. The Vulnerability page appears. In this page, you can view and sort data about CVEs.

   

• To view one or more additional columns in this page, or to remove a default column from this page, click on the Edit Column button.

• To sort by a column value, click the up and down arrows next to the column name.

• To filter by column value, click the funnel icon next to the column name. You can filter by more than one column. The first column you use as a filter will be the primary filter. You can further filter by additional columns.

• After creating a filter, you can click the Query Builder button to see a query that reflects the currently applied filters.

• After creating a filter, you can save the filter as a query or save the filtered results as a .CSV file.