Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco ScanCenter Administrator Guide, Release 5.2

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco ScanCenter Administrator Guide, Release 5.2

Chapter Title

Creating a Search

Results

Updated:
February 16, 2021

Chapter: Creating a Search

Creating a Search

Overview

Reports are generated by running one of the three available search types. Searches are refined by time period and filters.

Procedure

Step 1

Click the Reports tab to display the Reports menu.

Step 2

On the Reports menu, click Search.

Step 3

Click the tab for the type of search to create. The tabs are:

  • Search
  • Time Analysis
  • Detailed Search

Creating a Standard Search

Procedure

Step 1

Select a time period.
Step 2

Add any required filters.
Step 3

Enter the number of primary attributes to be displayed in the View first box (1 to 20000).

Step 4

In the primary attribute list, click the required primary attribute.
Step 5

In the primary sort metric list, click the required primary sort metric. The available metrics are:

  • Name
  • Bandwidth
  • Browse Time
  • Bytes Received
  • Bytes Sent
  • Hits
Step 6

Click the hyperlink to change the primary sort order. The hyperlink indicates the current order. For descending order, the top n results are shown. For ascending order, the bottom n results are shown.

Step 7

Clear the check box to exclude secondary attribute criteria. Alternatively select the check box to enable additional criteria, and then:

  1. Enter the number of secondary attributes to be displayed in the and their first box (1 to 20000).

  2. In the secondary attribute list, click the required attribute.

  3. In the secondary sort metric list, click the required sort metric.

  4. Click the hyperlink to change the secondary sort order.

Note 
The product of the values entered in the View first and the and their first boxes must be no larger than 20,000.
Step 8

Click Launch Search. When the report has been generated, it is displayed below the button.

Creating a Time Analysis Search

Procedure

Step 1

Select a time period.

Step 2

Add any required filters.
Step 3

In the View list, click the number of attributes to display (1 to 12).

Step 4

In the attribute list, click the required attribute.
Step 5

In the sort metric list, click the required sort metric. The available metrics are:

  • Name
  • Bandwidth
  • Browse Time
  • Bytes Received
  • Bytes Sent
  • Hits
Step 6

Click the hyperlink to change the sort order.
Step 7

Click Launch Search. When the report has been generated, it is displayed below the button.

Creating a Detailed Search

Procedure

Step 1

Select a time period.

Step 2

Add any required filters.

Step 3

Choose between one and 15 reporting attributes to include in the report. The default attributes are Timestamp, Category, Group, Host, Internal IP, Path, Query, Rule Action, and User. To add one or more attributes:

  1. Click the Add/Remove columns hyperlink.

  2. In the attribute list, click the required attribute or attributes.

    To remove an attribute, hover over the attribute and click the Remove icon. Alternatively, Click the Add/Remove columns hyperlink, and then click the attribute or attributes you wish to remove. You cannot remove the Timestamp attribute.
Step 4

Click the attribute you want to sort by. Clicking the selected attribute changes the sort order, which is indicated by a triangle.

Step 5

Drag and drop the attributes to change the order of the columns in the report. Alternatively, accept the default order to use Timestamp as the sort order.

Step 6

Click Launch Search. When the report has been generated, it is displayed below the button.

What to do next

In some cases, the report shows no records. This could be caused by search criteria such as explicit filters or the specified time range. This could also be caused by the use of a derived attribute acting as an implicit filter.

Derived attributes are not directly mapped to columns in the database. Instead, they are derived from one or more database columns. For example, Content SHA256 is derived from a combination of Request SHA256 and Response SHA256. So, if both columns are NULL, then Content SHA256 is also NULL. By being implicitly filtered, the reporting service receives zero rows and shows no records.

Derived attributes include:

  • Adware

  • AMP Threat Name

  • Application Name

  • Block Category

  • Block Type

  • Block Value

  • Category

  • Content SHA256

  • Malware

  • Pattern Name

  • Pattern Type

  • Phishing

  • Policy Violation

  • PUA

  • Risk Class

  • Spyware

  • Threat Type

  • Virus

  • Web Reputation Threat

Allowed Traffic

You can also create a detailed report from an allowed traffic report. The allowed traffic report shows all of the allowed traffic by category for a single day. Security risks are shown as a colored icon in the hour column for the various filter categories with the following meanings:

  • Red—High security risk.
  • Yellow—Medium security risk.
  • Green—Low security risk.

Procedure

Step 1

Click the Reports tab to display the Reports menu.

Step 2

In the Reports menu, click Allowed Traffic.

Step 3

In the Type drop-down list, choose a filter type:

  • User
  • Group
  • Internal IP
Step 4

Enter a Date in the box or click the Calendar icon to choose a date.

Step 5

Enter a username, group name, or internal IP address in the User/Group/IP box, for example, default.

Step 6

Click Search to view the report.

Step 7

Click the icon to display a detailed report of the risk.

Downloading Detailed Reports as CSV

Downloading a detailed report in CSV (comma separated value) format enables you to open the report in a spreadsheet.

Procedure

Step 1

View the report as a grid.
Step 2

Click the CSV icon to download the report.

User Audit Reports

User Audit reports provide more details about a specific user. These reports cannot be scheduled or added to a composite report. However, you can export the report in PDF or CSV format as with other reports.

Procedure

Step 1

Click the Reports tab to display the Reports page.

Step 2

In the Reports menu, click User Audit.

Step 3

Enter the IP address or full username string of the User.

Step 4

Click Launch Search.

Creating a Search from a Predefined Search

Procedure

Step 1

Click the Reports tab to display the Reports page.

Step 2

View the report.
Step 3

Edit the report criteria.
Step 4

Click Launch search.

Storing a Search

When you have run a search to generate a report, you can store the search criteria for future use.

Procedure

Step 1

Click Save. Alternatively, click Save as to store a copy of the search. The Use current settings to create a new Report dialog is displayed.

Step 2

Enter a name for the search (up to 256 characters) in the Choose a report title box. Alternatively, select the use the default name check box to use the name next to the check box.

Step 3

In the Choose an existing folder from the list drop-down list, choose a folder. Alternatively, select the Create a new folder check box and enter a Folder name (up to 256 characters). If you select the default, (no folder), the search will be displayed at the top level.

Step 4

Click SUBMIT to store the search. Alternatively, click Close window to abandon storing the search.

Editing a Search

Procedure

Step 1

Run the search.

Step 2

Edit the search criteria.
Step 3

Click Save to apply your changes. Alternatively, click Save as to store the modified search with a new name.

Note 
You cannot replace a predefined search or a search that is part of a composite report. You must store the modified search with a new name.

Renaming a Search

Procedure

Step 1

Click the Reports tab to display the Reports page. Alternatively, on the Reports menu, click Reports.

Step 2

If the search that you wish to rename is contained within a folder, click the folder to display the search.
Step 3

Click the Rename icon.

Step 4

Enter a new name in the Enter new name box and press Enter. Alternatively, click the X icon to abandon renaming the search.

Removing a Search

Procedure

Step 1

Click the Reports tab to display the Reports page. Alternatively, on the Reports menu, click Reports.

Step 2

If the search that you wish to delete is contained within a folder, click the folder to display the search.
Step 3

Click the Delete icon. You will be prompted to confirm your action.

Step 4

In the dialog, click OK to remove the search. Alternatively, click Cancel to abandon removing the search.

Note 
You cannot remove a search that is part of a composite report. You must first remove the search from the composite report. You cannot remove predefined searches.

Removing an Empty Folder

Procedure

Step 1

Click the Reports tab to display the Reports page. Alternatively, on the Reports menu, click Reports.

Step 2

Click the Delete icon. You will be prompted to confirm your action.

Step 3

In the dialog, click OK to remove the folder. Alternatively, click Cancel to abandon removing the folder.

Note 
You cannot remove a folder that is not empty. You must first remove any stored searches from the folder.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Cisco Community Discussions

About Us
Contact Us
Work with Us