RSA Admin

Problem with a Dashboard Report for Top Alerts of a Device Group

Discussion created by RSA Admin Employee on Nov 12, 2009



I would like to create a new Dashboard Report for the Top Categories of the occoured Alerts.

With the default Report Alert - Top Categories it is not possible to modify the Report, and choose it only for a device Group. The Problem is, that the device group can not be correlated with the Alert table.

I found another possibility to reach my goal nearly:


I've created a Report with the Alert Table, selected the Fileds count(Type) for the Y axies and Type for the X axies. To limite the results to one Alert-View I made this where clause: ViewName='<Name-of-the-View'. Every things works so far.


The Problem is that the selected filed 'Type' only shows the Number of the Category e.g. 1601 and not the Name, which is not very sexy.


Is it somehow possible to do a lookup of the CategoryName with the Type? Or has someone a better solution?