The Mandiant Advantage Security Validation (MA-SV) includes the ability to build and export custom reports that provide critical insight into the performance of your security tools. Custom reports use information from Job Actions and can be configured to show data in a graphical or tabular display.
The Analyze > Reports page is where you export, view, edit, duplicate, and delete reports created by you or imported from other Directors. When you open a Job Report, the last saved version of that report is displayed. See Viewing Job Reports for information. You can return to the Report Builder page from any Job Report by clicking the < Reports button.
You can specify the time range a Job Report pulls results from. You can also apply data rules, or filter rules, that broaden or narrow the scope of results included in a Job Report. By default, all widgets added to a Job Report adhere to the same time range and filter rules, but you can modify the dataset for each individual widget when editing that widget.
When you create a Job Report, you can:
- Configure the Data Source, including
- Time Range
- Filter Rules
- Add Components, including
- Layout/Structure Components
- Content Widgets
- Charts/Data Visualization
- Add or create a tag, which lets you filter reports by tag. Adding a tag makes searching for reports easier.
- Save and export the Report
For more information about reports, see Managing Job Reports.
The Analyze > Reports page
Understanding the Components of a Job Report
Components are the elements that determine a report's layout/structure, content widgets, and charts/data visualization. Multiple components can be selected to customize a Job Report's visual presentation.
The Reports Panel Library, which opens when you add a new component to a Job Report
Layout/Structure Components
Layout/Structure components are containers and dividers that organize space in a Job Report. After you add a container Layout/Structure component, you can add either content widgets or charts/data to the columns inside that component. These components include the:
- Left Weighted Two Column Container
- Page Break
- Right Weighted Two Column Container
- Template Section
- Three Column Container
- Two Column Container
You can add individual components, or widgets, without nesting them inside Layout/Structure components. By default, individual components take up the entire width of the report. You can use a combination of nested and unnested components to emphasize certain parts of a Job Report. For example, you may not want to add a Text Content Editor to a column container to maintain its readability, or you may want to add a three column container of pie/donut charts to quickly compare the charts side by side.
See Adding Layout/Structure Components to a Job Report for details.
A Three Column Container with three Pie/Donut Charts inside
Template Sections
Template Sections are a special type of layout component -- a panel that can include multiple components. These panels can be assigned a timespan and data filters that are then automatically applied to all components you add to the panel. You can also update the timespan and data filters for the individual components in the template panel.
When you create a new report or select an existing one, you can click Add Component + and select Template Section from the Layout/Structure in the Panel Library. You can then add other components to the Template Section panel and drag-and-drop panels into and outside of the Template Section, as well as move components around within the Template Section panel.
Within each panel inside a Template Section, you can edit the panel's widget, duplicate the panel, delete it, or view request data.
A Template Section with Multiple Components
Data Looping
With Template Sections, you can group together top level sets of components, for which you can enable data looping in the Edit Widget window. The looping templates provide the ability to filter through data identified by different properties. You can apply any structure that you can put in a regular template. When you apply the different looping types to them, you get an improved way of exposing a portion of the data. Then, you can navigate through the data using pages, which are displayed to step through each item in the dataset.
Data looping allows the components within the Template Section panel to loop (or repeat), once for each item in a set of data. For example, you could enable data looping to:
- Repeat a set of panels for each Job
- Repeat for each Stage of Attack
- Repeat for each Action/VID
- Repeat for each NIST Control/NIST Control Family
Video: MSV Reports Data Looping
When you select the looping style, you can select from the following Group By options from the drop-down list:
- Job (each page is a unique Job ID)
- Stage of Attack
- Action/VID
- MITRE ATT&CK
- Tactic
- Technique
- Sub-technique
- NIST 800-53
- Control
- NIST 800-53 Control Family (each page contains Job Action results for Actions containing NIST Control tags belonging to a single Control Family)
With data looping, you can select how data inside the template is going to be looped. For example, if you select MITRE ATT&CK from the Group By list, you can "loop" on Tactic, Technique, or Sub-technique. If you loop on Tactic, the data inside the template is limited to data that's relevant to the tactic property. Pagination controls are displayed in the upper-right corner of the template to enable you to step through each item in the dataset.
Looping Over MITRE ATT&CK Tactic
In the Looping over MITRE ATT&CK Tactic example, the template is limiting the Jobs to only the ones that are tagged for this initial tactic.
You can nest templates by duplicating the same structure, dragging it into the template, and then modifying it by editing the widget. You can apply overrides to duplicate element to dig deeper into the data.
Duplicating template
Editing Widget
Content Widget Components
Content Widgets are different ways of presenting text-based content in a Job Report. These components include:
- Data Table
- Text Content Editor
Text Content Editors provide the space to contextualize report findings, explain the report's rules and methodologies, add notes, and more. Data Tables present large amounts of data for in-depth analysis, with options to sort or group contents for easier comparison between Actions, Stages of Attack, or Attacker Behaviors.
See Adding Content Widgets to a Job Report for details.
Two Text Content Editors - one being used to summarize the report and the other to introduce the Pie/Donut charts that follow
Charts/Data Visualization Components
Charts/Data Visualization components are different ways of presenting visual content in a Job Report. These components include:
- Bullet Chart
- Force Field Chart
- Job Action Results Line Chart
- Overview Card
- Pie/Donut Chart
- Single Stat
- Spiral Chart
- Stacked Bar Chart
- Threshold Radar Chart
- Tree Map Chart
- Trending Threshold Chart
The Pie/Donut, Spiral, and Single Stat Charts are used to display easily consumable statistics. The Bullet Chart, Force Field Chart, Stacked Bar, Trending Threshold, Threshold Radar, and Job Action Results Line Charts are used to display multiple statistics or Job Action results over time. The Overview Card gives you the flexibility to combine multiple Charts/Data Visualization components together in a single presentation. The Treemap Chart lets you visualize levels of success validating against multiple categories, including MITRE ATT&CK Tactics and NIST 800-53 Control Families.
See Adding Charts/Data Visualization to a Job Report for details.
Four Charts/Data Visualization components that show statistics over a two-month period