You can turn any search query or statistics into a subchapter to add to your reports. This is an easy and flexible way of creating reports to monitor traffic, track certain parameters, or get alerted about particular events.
To create a search-based report subchapter from search results
-
Navigate to Search, and perform a query of your choice.
-
Click Search. Search results are displayed.
- Click
Create report. The Create new subchapter page is displayed, with the Query field populated with your query. If the Query field is not populated, enter a valid search query.
Figure 304: Search > Create report - Example subchapter created from search results with Query field populated
-
In the Name field, add a name to your report.
- In Subchapter type, select the type that fits your query. You can choose from the following types:
- Sessions list: Displays a list of sessions.
Set the number of sessions to show in the report as required.
- Timeline: Visualizes the distribution of sessions within a day/week/month, depending on the time range chosen for the report under Reporting > Configuration > Generate this report every > Day/Week/Month.
- Statistics: Visualizes the distribution of sessions based on the selected metadata.
Select a Statistic presentation for your report, such as List, Pie chart, or Bar chart. Select the field (the metadata) to create your statistics on.
-
To add the subchapter to an existing report, click Add to a report and select from the list of available reports.
Alternatively, to configure a custom report from scratch, click Include in a new report. For more information, see Configuring custom reports.
The following describes how to create a search-based report subchapter from scratch.
To create a search-based report subchapter from scratch
-
If you have multiple SPS appliances and they are organized into a cluster where one of the nodes is the Search Master (or Central Search) node, log in to that node.
- Navigate to Reporting > View & edit subchapters > Search-based.
- Click Create new. The Create new subchapter page is displayed.
Figure 305: Reporting > View & edit subchapters > Search-based — Create new subchapter
- In the Name field, add a name to your report.
- In the Query field, type the query that you want to create a report from.
- In Subchapter type, select the type that fits your query. You can choose from the following types:
- Sessions list: Displays a list of sessions.
Set the number of sessions to show in the report as required.
- Timeline: Visualizes the distribution of sessions within a day/week/month, depending on the time range chosen for the report under Reporting > Configuration > Generate this report every > Day/Week/Month.
- Statistics: Visualizes the distribution of sessions based on the selected metadata.
Select a Statistic presentation for your report, such as List, Pie chart, or Bar chart. Select the field (the metadata) to create your statistics on.
- Click Save.
- Click
. Alternatively, navigate to Reporting > Create & Manage Reports.
- Configure a custom report from scratch, or add the subchapter to an existing report. For more information, see Configuring custom reports.
When adding the subchapter you created, look for it under Reporting > View & edit subchapters > Search-based.
This section describes the database tables, views, and functions of One Identity Safeguard for Privileged Sessions (SPS). Generally, views contain a more organized dataset, while tables contain the raw data.
NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.
Table 12: Database tables and views for custom queries
| alerting |
table |
The list of alerting events. For details, see The alerting table. |
| aps |
table |
[OBSOLETE] The list of Audit Player indexing services that are available for SPS. For details, see The aps table. |
| archives |
table |
Data about the archiving processes. For details, see The archives table. |
| audit_trail_downloads |
table |
Data about the audit trail downloads. For details, see The audit_trail_downloads table. |
| channels |
table |
Contains metadata about the channel-opening requests and opened channels. This is the main table storing data about the connections. For details, see The channels table. |
| closed_connection_audit_channels |
view |
This view returns all audited channels whose connection have been closed. For details, see The closed_connection_audit_channels view. |
| closed_not_indexed_audit_channels |
view |
This view returns all audited channels whose connection have been closed, but have not been indexed yet. For details, see The closed_not_indexed_audit_channels view. |
| connection_events |
view |
List of commands or window titles detected in the connections. For details, see The connection_events view. |
| connection_occurrences |
view |
Contains the tokens that are used as search keywords in Content subchapter reports (reports from audit-trail content) and where these tokens appear in the audit trails. For details, see The connection_occurrences view. |
| connections |
view |
A view containing data of the connections. This data is identical to the information available on the Search page. For details, see The connections view. |
| events |
table |
The commands or events extracted from the indexed audit trails. For details, see The events table. |
| file_xfer |
table |
Data about the files transfered in the audited connections (SCP, SFTP). For details, see The file_xfer table. |
| http_req_resp_pair |
table |
Information about the requests and responses in HTTP and HTTPS sessions. For details, see The http_req_resp_pair table. |
| indexer_jobs |
table |
Information and statistics about indexer jobs. For details, see The indexer_jobs table. |
| occurrences |
table |
Contains the tokens that are used as search keywords in Content subchapter reports (reports from audit-trail content) and where these tokens appear in the audit trails. For details, see The occurrences table. |
| progresses |
table |
[OBSOLETE] Which audit trail is assigned to which Audit Player for processing. For details, see The progresses table. |
| results |
table |
Contains the tokens that are used as search keywords in Content subchapter reports (reports from audit-trail content) and in which audit trails were these tokens found. For details, see The results table. |
| skipped_connections |
table |
List of errors encountered when processing audit trails. For details, see The skipped_connections table. |
| usermapped_channels |
view |
Information about sessions where usermapping was performed in the connection. For details, see The usermapped_channels view. |
Detailed information about this topic
NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.
Table 13: Columns of the alerting table
| alerting_time |
timestamp |
The timestamp of the alert. |
| alerting_type |
text |
The type of the alert. |
| channel_id |
integer |
This value is a reference to the ID of the channels table where the event occurred. |
| matched_content |
text |
The matched content. |
| matched_regexp |
text |
The matched regular expression. |
| rule_name |
text |
The name of the content policy rule. |
