Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Report Category

ReportsSource Type

Data Source (file-based or scriptbased)

Update Frequency
DeviceInactive IP Addressesib:reserved2

file-based (syslog)

Rotates at 120 MB; retains one older copy; queued data is between 120 MB and 240 MB

Port Capacity Utilization by Device

Port Capacity Trend

Port Capacity Delta by Device

ib:reserved2

file-based (csv)

Overwritten every 6 hours


End Host History

ib:discovery:end_host _activity

file-based (csv)

Overwritten every 24 hours

DHCP Performance

DHCP Message Rate Trendib:dhcp:messagefile-based (csv)

Overwritten every 1 minute

DHCPv4 Usage Trend

DHCPv4 Range Utilization Trend

ib:dhcp:rangefile-based (csv)

Overwritten every 1 hour

DHCP Lease History




DHCP Lease History

DHCP Top Lease Clients

ib:dhcp:lease_history

file-based (syslog)

Rotates at 120 MB; retains one older copy; queued data is between 120 MB and 240 MB

Top Devices Identified

Device Trend

Device Class Trend

Top Device Classes

ib:dhcp:lease_historyfile-based (syslog)

Based on summary search report, which is updated during the 16th and 46th minutes of each hour

Top Devices Denied an IP Addressib:dhcp:lease_historyfile-based (syslog)Based on summary search report, which is updated during the 19th and 49th minutes of each hour

Device Fingerprint Change Detected

ib:dhcp:lease_historyfile-based (syslog)

Executed every 24 hours

DNS Performance


DNS Response Latency Trendib:dns:perfscript-based

Executed every 1 minute

DNS Effective Peak Usage Trend
for Flex Grid License

ib:dns:perf


Executed every 10 minutes and average is calculated over five days

DNS Record Scavenging

DNS Scavenged Object Count Trend

ib:dns:reclamation

file-based (csv)

Updated whenever reclamation tasks are executed

DNS Query Capture

DNS Domain Query Trend

DNS Domains Queried by Client

Top DNS Clients by Query Type

Top DNS Clients Querying MX Records

ib:dns:capture

file-based (csv)

Updated whenever the Data Collection VM collects capture query data from a Grid member

DDNSDDNS Update Rate Trendib:ddns

file-based (syslog)

Rotates at 120MB; retains one older copy; queued data is between 120MB and 240MB.

DNS Traffic Control





DNS Traffic Control Resource

Availability Trend

ib:dns:reserved

file-based (csv)

Based on summary search report, which is updated once per six hour at 47th minute of each hour. With each execution, it summarizes raw events indexed from 370 minutes ago to 10 minutes ago.

DNS Traffic Control Resource

Availability Status

ib:dns:reserved

file-based (csv)

Based on summary search report, which is updated once per six hour at 47th minute of each hour. With each execution, it summarizes raw events indexed from 370 minutes ago to 10 minutes ago.

DNS Traffic Control Resource Pool

Availability Trend

ib:dns:reserved

file-based (csv)

Based on summary search report, which is updated once per six hour at 23rd minute of each hour. With each execution, it summarizes raw events indexed from 370 minutes ago to 10 minutes ago.

DNS Traffic Control Resource Pool

Availability Status

ib:dns:reserved

file-based (csv)

Based on summary search report, which is updated once per six hour at 23rd minute of each hour. With each execution, it summarizes raw events indexed from 370 minutes ago to 10 minutes ago.

DNS Traffic Control Response

Distribution Trend

ib:dns:reserved

file-based (csv)

Based on summary search report, which is updated once per six hour at 37th minute of each hour. With each execution, it summarizes raw events indexed from 370 minutes ago to 10 minutes ago.

DDI Utilization




DHCPv4 Usage Statistics

DHCPv4 Top Utilized Networks

ib:dhcp:network

file-based (csv)

Overwritten every 1 hour

IPAM Network Usage

IPAM Top Networks

ib:ipam:network

file-based (csv)

Overwritten every 1 hour

DNS Zone Statistics Per DNS Viewib:dns:view

file-based (csv)

Overwritten every 24 hours

DNS Statistics per Zoneib:dns:zone

file-based (csv)

Overwritten every 24 hours

IPAM Utilization

DNS Object Count Trend for Flex
Grid License

ib:dns:summary

file-based (csv)

Generated once in 24 hours for all IB-FLEX members on the Gridand average is calculated over 5 days

System Utilization

CPU Utilization Trend

Memory Utilization Trend

Traffic Rate by Member

ib:systemscript-based

Executed every 1 minute

License Pool Utilizationib:system

file-based (csv)

Overwritten every 24 hours

Flex Grid Licensing Features
Enabled
ib:system


Generated once in 24 hours for all IB-FLEX members on the Grid

System Capacity

System Capacity Prediction

ib:system_capacity:objects


Updated whenever there is relevant event occurs

DNS Query






DNS Replies Trendib:dns:statsscript-based

Executed every 1 minute

DNS Cache Hit Rate Trend

ib:dns:query:cache_hit_rate

script-based

Executed every 1 minute

DNS Query Rate by Query Typeib:dns:query:qpsscript-based

Executed every 1 minute

DNS Query Rate by Member

DNS Daily Query Rate by Member

DNS Daily Peak Hour Query Rate by Member

ib:dns:query:by_member

script-based

Executed every 1 minute

DNS Top Clients

ib:dns:query:top_clients

script-based

Executed every 10 minutes

DNS Top Requested Domain

Names

ib:dns:query:top_requested_domain_names

script-based

Executed every 10 minutes

DNS Top Clients Per Domain

DNS Top NXDOMAIN / NOERROR (no data)

DNS Top SERVFAIL Errors Received

DNS Top SERVFAIL Errors Sent

DNS Top Timed-Out Recursive Queries

ib:dns:reservedscript-based

Executed every 10 minutes

DNS Query Trend per IP Block Group

ib:dns:reservedscript-based

Executed every 5 minutes

Security







DNS Top RPZ Hitsib:dns:reservedscript-based

Executed every 10 minutes

DNS Top RPZ Hits by Clientsib:dns:reservedscript-based

Executed every 10 minutes

Top DNS Firewall Hitsib:dns:reservedscript-based

Executed every 10 minutes

Malicious Activity by Clientib:dns:reservedscript-based

Executed every 10 minutes

DNS Firewall Executive Threatib:dns:reservedscript-based

Executed every 10 minutes

FireEye Alertsib:syslogscript-based

Updated immediately when alerts are logged in the syslog.

Threat Protection Event Count By Severity Trend

Threat Protection Event Count By Member Trend

Threat Protection Event Count By Rule

Threat Protection Event Count By Time

Threat Protection Event Count By Category

Threat Protection Event Count By Member

ib:reserved1

file-based (csv)

Overwritten every 5 minutes.

DNS Top Tunneling Activity

DNS Tunneling Traffic by Category

Top Malware and DNS Tunneling

Events by Client

ib:reserved1

file-based (csv)

Overwritten every 5 minutes.

Network User

User Login Historyib:reserved1

file-based (csv)


Ecosystem Subscription

Subscription Dataib:reserved1

file-based (csv)

Updated whenever there is an event received from the vendor that NIOS subscribes.

Ecosystem Publication

Publish Dataib:reserved1

file-based (csv)

Updated whenever there is a relevant RPZ, IPAM, and DHCP lease event occurs.

CloudVM Address Historyib:reserved2

file-based (csv)

Updated immediately when there is a change related to the VM IP address. Rotates at 300MB and retains one older copy.

Audit LogAudit Log Eventsib:audit

file-based (audit log)

Updated immediately when the audit log is updated.

SyslogSyslog Eventsib:syslog

file-based (Syslog)

Updated immediately when alerts are logged in the syslog.

...