Analytics and Dashboards
View and analyse data and statistics for both Analyst and Member Portals.
Dashboards
Analysts can create and maintain custom dashboards. Using dashboards, analysts can visually present vital performance metrics based on real-time information.
Analysts can share the dashboards with members and across an organization for additional transparency.
Analysts can also query and represent data in graphical formats, such as widgets or charts, for a more complete view, at a glance.
Analysts can also create and save multiple dashboards to view different presentations of information, based on the metrics they want to represent.
Create a Dashboard
Create dashboards to view the visual representation of the data in . As an analyst, you can create a dashboard for both analysts and members.
Steps
To create a dashboard, follow these steps:
Sign in to the Analyst Portal and go to Dashboard.
Click Create Dashboard if you are creating dashboards for the first time, otherwise, click Add Dashboard. Use the following information while adding dashboards:
Dashboard Name: Enter a name for your dashboard.
(Optional) Description: Briefly describe the dashboard. When the dashboard recipients hover over the info icon of the dashboard, they can view this description.
Create Dashboard For: Select if you want to share the dashboard with analysts or members. If you choose to create the dashboard for analysts, you must create the dashboard, and then share it with the intended recipients.
If you choose to share this dashboard with members, you can choose to either create it for all members or select one recipient group for the dashboard:
Member Users: When you create a dashboard for member users, the data aggregated in the dashboard widgets are filtered based on the member users with whom you have shared the dashboard. After creating the dashboard, you can share it by clicking the vertical ellipsis of the dashboard and clicking Share Dashboard. You can then share the dashboard with the intended recipients.
Recipient Group: This dashboard is visible only to the member users in the selected recipient group. The data aggregated in the dashboard widgets are filtered based on the selected recipient group.
Select a Layout: Select the layout for the dashboard. You can either choose a preconfigured template layout or customize the layout based on your preference.
Click Create Dashboard. The dashboard is now created and ready to be populated with widgets of your choice. In the dashboard, click a container to edit it.
You can either add a new widget or modify an existing one. Select the widget that you want to add to your dashboard and click Add. Before adding the widgets, preview them for visual confirmation of how they will appear. You can also search for a specific widget by typing the widget name in Search, or clicking the Category drop-down menu and selecting a category. Note that by using this option, the list of available widgets is contextual and changes based on your input. The widget is now available in the dashboard container you have specified.
Alternatively, you can add a row of widget types. If you hover over a container, a positional tooltip appears, with the options Add Overview Widgets or Add Information Widgets. Select one of these options and specify the number of columns by clicking one of the available options. A row with the widget container types that you specified is now added to your dashboard.
To save your changes, click Save Dashboard.
Edit Dashboard
As an analyst, you can modify and update the dashboards that you have created. You can add or replace widgets, or edit the name and description of the dashboard.
Before you start
You can only edit a dashboard that you have created. For more information on creating a dashboard, see Create a Dashboard.
Steps
To edit a dashboard, do the following:
In the sidebar, click Dashboards.
Go to the dashboard you want to edit, click the vertical ellipsis, and click Edit Dashboard.
To add a new widget columns, click Add Information Widgets. You can select if you want to add one or two widget columns. Click + to add the widgets to the columns. Select the widget that you want to add to your dashboard and click Add. You can also search for a specific widget by typing the widget name in Search, or clicking the Category drop-down menu and selecting a category. Note that by using this option, the list of available widgets is contextual and changes based on your input.
To replace or change an existing widget, click the vertical ellipsis of the widget, and click Replace.
To add overview widgets or hero cards to the dashboard, hover above all the existing widgets, and click Add Overview Widgets.
To edit the name and description of the dashboard, click Settings in the upper-right corner. If you have shared the dashboard with a member recipient group, you can choose to update the recipient group.
To save your changes, click Save Dashboard.
View CSAP Dashboards
View and perform the following actions for the dashboards:
Refresh Dashboard: Dynamically refreshes application data in the dashboard to reflect the most current information from across your CSAP instance.
Full Screen: Views the dashboard in full-screen mode. To return to the browser view, press Esc.
Auto Scroll: A play button that can trigger a series of rotating dashboards as a playlist (for example, for presenting on a screen). To return to browser view, press Esc.
Dark Mode: Toggles between a light theme and a dark theme.
Analyst or Member: Toggles between the analyst dashboard and the member dashboards.
Delete Dashboard
Delete the dashboards
Before you Start You must have first created a dashboard or have access to an existing dashboard. For more information on creating a dashboard, see Create a Dashboard.
Steps
Select Dashboards and choose a dashboard to delete.
Note
If the tab for the dashboard that you want to modify is not currently displaying on Dashboards, click More and then select your dashboard. The tab is now available for interaction.
Select Delete Dashboard.
Click Delete to delete the dashboard.
Clone, Export, and Share Dashboards
Prerequisite: You must have first created a dashboard or have access to an existing dashboard. For more information on creating a dashboard, see Create a Dashboard.
On the Dashboards page, navigate to the dashboard for which you want to set by clicking the vertical ellipsis icon on the right-hand side of the tab for your dashboard
Note
If the tab for the dashboard that you want to modify is not currently displaying in the Dashboards page, click More and then select your dashboard. The tab is now available for interaction.
Select one of the following options:
Default Dashboard: Selecting this option makes the dashboard you have specified the default view when you open the Dashboards page.
Note
If you make a dashboard your default dashboard, you are not able to share it.
Edit Dashboard: Select this option to edit your dashboard. For more information, see Edit Dashboard.
Clone Dashboard: Selecting this option creates a separate, identical instance of your current dashboard that you can rename and modify, as needed. By default, when you clone a dashboard, an indication that the new dashboard is a copy is prepended to the title. For example, if your current dashboard is titled My Dashboard, the cloned dashboard title displays as Copy of My Dashboard.
Share: Opens the Share Dashboard dialog box, where you can select the privileged users with whom you want to share your dashboard. This allows the specified users to interact with the data in view-only mode. Options include Private, Selected User(s), and All Users. To complete the share action, click Share Dashboard.
Note
If the dashboard you are viewing is your default dashboard, you are not able to share it.
Export Dashboard: Opens the Export Dashboard dialog box, where you can select a format for export. The following options are available:
Download as PDF: Select this option to download a PDF snapshot of the dashboard to your machine. To complete the export action, click Export Dashboard.
Send as Email: Select this option to send the dashboard, as an email, to recipients that you specify. You can search for and add user emails by typing in the Enter Recipient Email(s) text field. Suggested emails populate, based on the characters you type. You can add multiple emails in the text field at one time, as well as remove individual email recipients by clicking the X icon next to the email entry. To complete the export action, click Export Dashboard.
Note
You cannot send dashboards to email addresses that have not been added as CSAP users.
Schedule Report: Select this option to schedule reports, in PDF format, as snapshots of your dashboard. These reports display your dashboard metrics as they appear on your screen at the time the report is run.
You can create multiple schedules to burst dashboard reports (for example, for different time intervals or for different users), as well as view them as cards in the Schedule Report dialog box.
To create a schedule, click Add New. The Create Schedule Report dialog box opens. Fill out the following required fields:
Name: Specify a name for your schedule.
Frequency: Specify the frequency at which reports are generated. Available options include Everyday, Weekly, Biweekly, Monthly, and Quarterly.
Start Day and Time: Specify the date and time you want to start generating reports by selecting a date from the calendar tool.
Recipient(s): Specify the users to whom you want to send the reports. Note that a valid email address must be entered for all recipients.
Timezone: Specify the time zone for which you want the report to be generated by clicking the drop-down menu and selecting a time zone (for example, (GMT- 5:00) Eastern Time (US and Canada)).
When you are finished, to create your schedule click Save Schedule.
Once a schedule is created, you can copy it, edit it, or delete it by clicking the icons at the top of the schedule card. If you have multiple schedules expanded, you can collapse them by clicking Collapse All. Alternatively, you can click Expand All to expand all schedule cards.
Delete Dashboard: Select this option to delete your dashboard. For more information, see Delete Dashboard.
Your changes are automatically saved in the Dashboards page.
Reports
Analysts can use reports to view data related to different modules in the Analyst Portal such as status and breakdown of alerts, device distribution, incident stats, intel submissions, surveys, and personalized keywords in graphical formats.
From reports, analysts can:
Filter and view data by a time frame.
Visualize data in graphical formats or using a tabular structure.
Export the data into a CSV file for offline analysis.
Manage Reports
Analysts can visualize data and manage reports.
Before you Start
You must have the View and Create/Update permissions to access the features in the Reports module. These permissions can be assigned only to a role.
All Reports
All Reports collate the most important graphs and tables that help analysts manage their day-to-day tasks through one centralized page.
Select Graph to view the reports in graphical formats.
Select Table to view the reports in a tabular format with all the available details.
Use Export to export the report in a .csv format to your computer.
Use Create to create a custom report based on a selected date range.
Click View Download to view different reports downloaded by users.
Alert Status
Alert status displays the status of all the alerts created in the Analyst Portal. Privileged users can get a quick overview of the alert status using this graph and easily monitor the flow of alerts from alert creators and publishers to the members. These statistics are also helpful for the security teams to get direct insights into the most urgent and actionable alerts.
You can view the following alert statistics using this report:
Published: Alerts published to the members
Scheduled: Alerts scheduled to be published at a specific time
Submitted: Alerts submitted by a creator to a publisher for review
Expired: Alerts marked as expired from the Analyst Portal.
Drafts: Alerts saved in draft
Alerts - By Push Notifications
This section displays the total number of alerts published with and without push notifications. Push notifications appear as banners on the device and members can navigate to the alert content by directly clicking on the notification. These notifications are used to convey important alerts to members. Use this report to gain insights into the frequency of push notifications. You can view this report in the Graph or Table format.
Alerts - By Category
Categories are separate classifications that are assigned to alerts published from the Analyst Portal. Classifying alerts into different categories helps in the organized distribution of useful information to appropriate members within the organization. This report gives you information on the most-used categories and the number of published alerts they were used in.
Alerts - By Recipient Group
Members are categorized into different recipient groups to share targeted alerts. There are three primary categories of recipient groups - public groups, invite-only groups, and system groups. Privileged users can quickly get to know the volume of alerts shared with different recipient groups. This report gives you information on the most-used recipient groups and the number of published alerts they were used in.
Alerts - By Info Source
An info source or information source is a person or entity from who the intelligence or data for the alert has been sourced. Info sources in CSAP may be a critical vendor, a government source, a public source, a private organization source, or more. This report gives you information on the most-used info sources and the number of published alerts they were used in.
Alerts - By Location
View the published alert count for different locations. Analysts can share alerts with all or select members at a specific location. Privileged users can gain quick insights into alerts shared with Members from different locations and analyze the data as per their requirements.
Alerts - By Date
View the count of the published alerts along with their date of publishing. The statistics can be used by publishers to analyze the number of alerts published in a day on the Analyst Portal.
Intel Reported - By Date
View the number of threat intel reports submitted by members along with their date of submission. Members can submit intel through Mobile App and Member Portal. Threat intel is critical in providing insights into new and existing security threats that may require immediate attention.
RFI Requested - By Date
The RFI is a report that can be used by the Members to obtain important information from the security team or other team members about the topics of interest or to inform the steps taken by the security team to support and improve the overall security posture. Privileged users can check the details of the pending RFI requests and respond to them.
User Status
View the user registration status count of analysts in the Analyst Portal and members in the Member Portal. These statistics help admins easily track the registration status of users who have been invited to the CSAP platform. Admins can track the number of active and inactive users in the application. Click Create to create a custom report based on a selected date range.
Published Alerts Status
View the recipient statistics of all alerts published from the Analyst Portal. It includes details such as the alert ID, alert title, total number of recipients, recipients who have read the alert, and the total feedback provided on the alert. Analysts can also view the push notification status of the alert to gain insights into the recipient statistics and increase member engagement on important alerts.
Select Graph to view the reports in graphical formats.
Select Table to view the reports in a tabular format with all the available details.
Use Export to save the report in a .CSV format to your computer.
Use Create to create a custom report based on a selected date range.
Click View Download to view different reports downloaded by users.
Detailed Alert - Read Status Report
Analysts can create detailed reports for the alerts read by the members. The report will contain the alert details such as alert ID and title, publisher information, published date, reader’s name, reader’s email address, category, and the total reader count for all alerts within the selected date range.
Select Graph to view the reports in graphical formats.
Select Table to view the reports in a tabular format with all the available details.
Use Export to save the report in a .CSV format to your computer.
Use Create to create a custom report based on a selected date range.
Click View Download to view different reports downloaded by users.
Detailed Survey - Participant Status Report
Analysts can create survey participant reports for all surveys published from the Analyst Portal. The report contains survey details, publisher information, published date, participant name, participant email address, and the total participant count for all surveys within the selected date range.
Select Graph to view the reports in graphical formats.
Select Table to view the reports in a tabular format with all the available details.
Use Export to save the report in a .CSV format to your computer.
Use Create to create a custom report based on a selected date range.
Click View Download to view different reports downloaded by users.
Most Common Tags - Member Channels
View the most popular tags used in member channels. Generate a report to view the top 50 common tags and the number of member channels they are used in.
Most Common Tags - Published Alerts
Gain insights into the most frequently used tags in published alerts for a specified date range. Create and download custom reports to view the top 50 tags and their usage frequency in published alerts.
Active Members
View the statistics of active and inactive members for a specified date interval. Members who have logged into CSAP through web or mobile applications during the specified period are considered active. Create and download custom reports to view the list of the active (displayed as TRUE) or inactive (displayed as FALSE) status of members. You can either create a report for all users or filter members by their recipient groups (groupset, TLP, or group type).
Report Management
Notice
This feature is available in CSAP v3.7.1.0 onwards.
Use Report Management in the Analyst Portal to schedule and manage system-generated reports sent as emails. These reports give statistics about members and alerts. You can change the email subject line along with suffixes and prefixes, add recipients, and schedule the time for sending the report.
Schedule Weekly User Report
In this report, view the number of active members, new members registered, total members, and other member-related statistics. You can also view alert statistics, such as the number of new alerts published, the total number of alerts, the number of alerts sent with notifications, and other alert-related statistics.
Steps
To edit email details and schedule the weekly user report, do the following:
In the Analyst Portal, go to Administration > Report Management.
Hover over Weekly User Report, click the vertical ellipsis, and click Edit.
Enter a prefix, email subject, and suffix to help you categorize this email report. For example, you can enter Important as a prefix, CSAP Weekly User Report as the email subject, and Review as a suffix.
Select the time zone, date, and time to send the report. The report is sent every week at the specified date and time.
Enter the email addresses of the recipients. If you want to add more than one email address, separate the email addresses by a comma.
After making the required changes, click Update.
Schedule Monthly Entitlement Report
In this report, view the list of users who have permission to publish and schedule alerts. Administrators can review this list to make sure that users have the appropriate permissions to review and publish alerts.
Steps
To edit email details and schedule the monthly entitlement report, follow these steps:
In the Analyst Portal, go to Administration > Report Management.
Hover over Monthly Entitlement Report, click the vertical ellipsis, and click Edit.
Enter a prefix, email subject, and suffix to help you categorize this email report. For example, you can enter Important as a prefix, CSAP Monthly Entitlement Report as the email subject, and Review as a suffix.
Select the timezone, week, day, and time to send the report. The report is sent every month at the specified weekday and time.
Enter the email addresses of the recipients. If you want to add more than one email address, separate the email addresses by a comma.
After making the required changes, click Update.
Schedule Daily Alert Report
In this report, view the list of all alerts that are published on a particular day. This report is sent to all members of an organization. Each member receives a report based on the alerts they receive during the day.
Steps
To schedule the daily alert report, follow these steps:
In the Analyst Portal, go to Administration > Report Management.
Hover over Daily Alert Report, click the vertical ellipsis, and click Edit.
Enter a prefix, email subject, and suffix to help you categorize this email report. For example, you can enter Important as a prefix, CSAP Daily Alert Report as the email subject, and Review as a suffix.
Select the timezone and enter the time at which the report is sent every day.
Select the Show Alert Summary checkbox to include a summary of every alert in the report.
After making the required changes, click Update.
Note
Members receive this email report if they have enabled the Daily Alerts Report in User Profile > Profile Settings > Email Subscription in the Member Portal.
Schedule Daily IR Report
As an analyst, you can schedule this report for members, where they can view alerts that are published and matched to the IRs that they follow.
Steps
To schedule the daily IR report, follow these steps:
In the Analyst Portal, go to Administration > Report Management.
Hover over Daily IR Report, click the vertical ellipsis, and click Edit.
Enter a prefix, email subject, and suffix to help you categorize this email report. For example, you can enter Important as a prefix, Daily IR Report as the email subject, and Review as a suffix. The default subject line is Daily Intelligence Requirement (IR) Report - {start_date}.
Select the time zone and enter the time at which the report is sent every day. The default time zone is UTC, and the default scheduled time is 5.30 PM.
After making the required changes, click Update. Members will now start receiving the email report based on the scheduled time.
Note
Members receive this email report only if they have enabled the Daily IR Report in User Profile > Profile Settings > Email Subscription in the Member Portal.