Knowledge Base
Knowledge Base
Breadcrumbs

Critical Resource Failure

The Critical Resource Failure report will show you the resources that failed a control with a severity of 8, 9 or 10. These are considered critical and makes it easy to visualize the high severity resources that should be addressed first.

  1. In Nexus, go to the Log Search tab located at the Log Search screen under Threat Management.

  2. Click on Visualizations.

    new pass 24.png

  3. Click the Create new visualization button.

    critical 2.png

  4. In the New Visualization pop up, select the Vertical Bar visualization option.

    critical 3.png

  5. Choose a source.

    critical 4.png

    1. In sources select <PARTNER_ACCT_ID>_<CUSTOMER_ACCT>_customer.

      1. Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the page or listed on the Account page followed by "_customer".

        critical 5.png


  6. Log Search will refresh to display the query screen. From here, the visualization can be configured.

    new failed 6.png

  7. Follow the documentation to add a filter for the reportId before moving to the next step.

  8. Two additional filters are going to be applied to this visualization:

    1. Click on Add filter

      new failed 7.png

    2. Set the first filter up to look like the below and click Save.

      critical 8.png

    3. Next hit the Add filter button again and set it up to look like the below and Save it.

      critical 9.png

  9. Under Metrics this should already be set to Y-axis Count. No change is needed.

  10. Two buckets are needed to configure this visualization. Under Buckets, click the Add button, making sure to select X-axis.

  11. In the Aggregation drop down, select Date Histogram.

  12. In the Field box, enter "@timestamp" or search for it.

  13. For minimum interval select 3 hours or type in "3h".

  14. Order by, Order and Size should all remain with their default values. Properly configured, the first bucket will look like the screenshot below:

    critical 10.png

  15. To add the second bucket, click the Add button underneath Buckets, making sure to select split series.

  16. In the Sub aggregation dropdown, select Terms.

  17. In the Field, enter "rule.Ctrl_Obj" and select it.

  18. Order by, Order and Size will be set to default. Properly configured, the second bucket will look like the screenshot below:

    critical 11.png


  19. When both buckets are configured, click the Apply Changes button.

    critical 12.png

  20. Set the date range for the visualization.

    1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

      critical 13.png


  21. Save the visualization by clicking Save in the top left of the screen.

    new pass 24.png

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.