Configuring data filter conditions

Use data filter conditions to specify which network security scan data/results will be included in the report. Only scans which match the specified criteria will be processed and presented within the report.

Screenshot 18 - Custom Report Wizard: Filters dialog

Click on the Add… button to bring up the ‘Edit filter properties’ dialog and configure the following conditions:

•	‘Filter condition’ – Specify the data source area on which the filter will focus (for example, select ‘Operating System’ to filter the events data related to a specific operating system).

•	‘Condition’ – Specify the condition comparison parameter.

•	‘Value’ – Specify the string to which source data will be compared.

For example to generate a report which contains only information related to Windows XP, configure your filter parameters as shown below:

Screenshot 19 - Filter conditions configuration dialog

For more specific reports, you can limit the range of information to be displayed by tightening your conditions/search criteria. This is achieved by configuring and applying multiple data filters against the selected data source. When more than one filter is used, specify how these filters will be logically linked. This is achieved by selecting a logical grouping condition from ‘Filter property condition…’ drop down list.

•	Select And to include ALL the scan data information that satisfies ALL of the conditions specified in the filters.

•	Select Or to include ALL the scan data information that matches at least one of the specified filter conditions.

Example: Using multiple filters

Consider the situation where a custom report has 2 filters configured as follows:

Screenshot 20 - Using multiple filters

Parameters	Filter 1	Filter 2
Filter condition	Hostname	Operating System
Logical relation	Is equal to	Is equal to
Value	’Mark’	‘Windows XP’

The data which will be included in this custom report will vary according to how these filters will be applied against your data. This is defined through the ‘Filter property condition…’ drop-down.

Filters applied			Data output
Filter 1	and	Filter 2	The report will show: • All scan data which is related to a host called ‘Mark’ which runs on ‘Windows XP’.
Filter 1	or	Filter 2	The report will show: • All scan data related to ‘Windows XP’ – (no matter which host it belongs to) AND • All scan data related to a host called ‘Mark’ – (no matter which operating system it has installed).

Example: Creating a custom report based on network security scans performed during a particular month

This example demonstrates how to generate a network vulnerabilities summary report called ‘Network vulnerabilities summary on hostname Mark for January 2007’. This report will be based on scans:

•	Related to a host named ‘Mark’

•	Corresponding to operating system ‘Windows XP’

•	Performed during the month of ‘January 2007’.

To create this report:

1. Click on the Default Reports navigation button.

2. Right-click on the report to be customized and select New > Custom Report. This will bring up the ‘Custom Reports Wizard’.

3. As soon as the welcome dialog is displayed, click Next.

Screenshot 21 – Selecting the data source to use

4. Select the ‘Scans over a date/month range’ option and click Next.

Screenshot 22 – Selecting the date/time period

5. Select the ‘Month’ option and specify the following parameters:

•	Month: ‘January’.

•	Year: ‘2007’.

6. Click on Next to proceed to the data filters dialog.

Screenshot 23 - Filter conditions dialog(s)

6. Click on the Add… button and configure the parameters of filter 1 as follows:

•	Filter condition: ‘Hostname’

•	Condition: ‘Equal to’

•	Value: ‘Mark’.

7. Click OK to finalize your filter configuration settings.

8. Click again on the Add… button and configure the parameters of filter 2 as follows:

•	Filter condition: ‘Operating system’

•	Condition: ‘is equal to’

•	Value: ‘Windows XP’

•	Filter Property condition…: ‘and’.

9. Click OK to finalize your filter configuration settings.

10. Click Next and specify the following parameters:

•	Report Name: ‘Network Vulnerability summary for January 2007’

•	Report Title: ‘Network security scans of hostname Mark’

•	Report Description: ‘This report shows a summary of vulnerabilities found on hostname Mark during January 2007.’

11. Click Next to proceed to the final dialog.

12. Click Finish to finalize your custom report configuration settings.