Top Failed Resources by ReportId

The Top Failed Resources by ReportId report provides a visualization of the top 5 resource types (Lambda, IAM User, S3 bucket, etc.) failing the in the cloud environment. These sources are visualized in the inner ring of the pie chart. Within each of those Top 5, the top 5 resources failing are then identified, visualized as the outer ring.

1. In Nexus, go to the Log Search tab located at the Log Search screen under Threat Management.

2. Click on Visualizations.

   

   
   

3. Click the Create new visualization button.

   

4. In the New Visualization pop up, select the Pie visualization option.

   

5. Choose a source.

   

   1. In sources select <PARTNER_ACCT_ID>_<CUSTOMER_ACCT>_customer.

      1. Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the page or listed on the Account page followed by "_customer".

      2. 
         

         If the account number is 1024 then the source will be <PARTNER_ACCT_ID>_1024_customer.
         

         

         
         

6. Log Search will refresh to display the query screen. From here, the visualization can be configured.

   

7. Click Add filter.

   

8. Type in "event.ReportId" into the Field box,

9. Select the Operator "is."

10. In the Value box, type in reportId.

    1. Find the reportId

11. Click the Save button.

12. Add another filter.

13. Type in "event.outcome" into the Field box,

14. Select the Operator "is."

15. In the Value box, type in FAIL.

16. Click the Save button.

17. Two buckets are needed to configure this visualization. Under Buckets, click the Add button, making sure to select split slices.

18. In the Aggregation drop down, select Terms.

19. In the Field box, enter "cloud.machine.type" or search for it.

20. Order by, Order and Size should all remain with their default values. Properly configured, the first bucket will look like the screenshot below:

    

21. To add the second bucket, click the Add button underneath Buckets, making sure to select split slices.

22. In the Sub aggregation dropdown, select Terms.

23. In the Field, enter "cloud.instance.id" to select it.

24. Order by, Order and Size will be set to default. Properly configured, the second bucket will look like the screenshot below:

    

25. When both buckets are configured, click the Apply Changes button.

    

26. Set the date range for the visualization.

    1. If the range encompasses more than one report, an additional filter with the report id can be added.

       

    
    

27. Save the visualization by clicking Save in the top left of the screen.

    

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.