Explore#
The Explore views of the web interface can be used to quickly look up information on exporters, hosts, and other entities (users, applications, etc.) in the Scrutinizer environment.
This section covers the different functions and types of information that can be accessed via the Explore views of the web interface.
On this page:
Devices#
The Explore > Devices tab is the default view when navigating to the Explore view and can be used to look up information for all devices sending flows to Scrutinizer collectors.
The main view lists device status, traffic information, and other details for each exporter and provides access to an information tray for drilling into related alarm and host views. The left-hand mapping/device group pane can be used to apply filters and manage mapping group settings, membership and connections.
Note
Information in the Devices view is based on the latest 1 hour and 5 minutes of data.
The Devices view lists exporter hostnames/addresses alongside the following details:
Current status of the exporter (green: available, red: offline)
Number of mapping groups the exporter is assigned to
Number of interfaces associated with the exporter
Average packets per second over the last 12 hours
Average flows per second over the last 12 hours
Timestamp of the most recent flow received from the exporter
The following options can be accessed by clicking the exporter address/hostname or the three-dot menu in the table:
Reports: Run any report supported by the exporter
Information: Shows general exporter information and links to the Admin > Exporters management view filtered on the exporter
Interfaces: Switches to the By Interface view filtered on the exporter
View Alarms: Opens the Alarm Monitor > Hosts view filtered on the exporter
Tags: View/manage custom tags for the device
Mapping: Edit object icon properties, mapping group membership, or location details for the exporter
Admin: Opens the Admin > Exporters management view (no filters applied)
Note
The bulk actions tray can be accessed after one or more exporters are selected using the checkboxes, and contains options to run reports, add custom tags, and edit mapping details for all selected exporters.
Mapping group pane#
The mapping group pane lists all current mapping/device groups and provides quick access to the following functions:
Run any report supported by the group’s devices/exporters
View the network map for the group
Apply a filter for the group’s exporters or interfaces to the main list/table (click the filters button for additional options)
Create a duplicate of the selected network map
In addition, the Modify option opens a tray where the settings, membership, connections or map background for the network map can be modified.
Interfaces#
The Explore > Interfaces tab can be used to look up information for all interfaces associated with devices sending flows to Scrutinizer collectors.
The Interfaces view is accessible by switching the toggle at the top of the Explore > Devices view. The left-hand mapping/device group pane functions identically to the one available in the Devices view and can be used to filter the main table by group and manage mapping group settings.
The main view lists the associated exporter as well as inbound and outbound activity details for each interface.
Note
Information in the Interfaces view is based on the latest 1 hour and 5 minutes of data.
The following options can be accessed by clicking the exporter address/hostname, interface name, or three-dot menu in the table:
Reports: Run any report supported by the exporter
Information: Shows general interface information and links to the Admin > Interfaces management view filtered on the interface
Exporter: Opens the Alarms subtab of the host details view for the exporter
View Interface: Opens the host details view for the interface
View Alarms: Opens the Alarm Monitor > Hosts view filtered on the exporter
Reset Highwater Inbound: Resets highwater mark data for inbound traffic
Reset Highwater Outbound: Resets highwater mark data for outbound traffic
Reset Highwater Both: Resets highwater mark data for both inbound and outbound traffic
Note
The units buttons can be used to toggle between bits, bytes, and utilization percentage in the Inbound and Outbound columns. Utilization will only be available for interfaces whose speeds are known (via SNMP or custom settings).
The bulk actions tray, which contains options to run applicable reports and reset highwater values, can be accessed after one or more exporters or interfaces are selected using the checkboxes.
Entities#
The Explore > Entities tab can be used to look up and inspect the individual data entities, both user-defined and discovered, monitored by Scrutinizer as part of network activity.
Note
Information in the Entities view is based on the latest 15 minutes of data.
The page is divided into separate subtabs displaying the following details for each entity type:
Usernames
Host associated with the observation
Data source
Machine name (if available)
Timestamp when the username was first seen on the host
Timestamp when the username was last seen on the host
Applications Defined
Number of exporters the application was observed on
Total number of flows with data associated with the application
Average packet rate for activity involving the application
Average data transfer rate for activity involving the application
Hosts - Sources/Destinations/Pairs
Source and/or destination IP address(es)/hostname(s)
Number of exporters the source, destination, or pair was observed on
Total number of flows with data associated with the host(s)
Average packet rate for activity involving the host(s)
Average data transfer rate for activity involving the host(s)
Autonomous Systems - Sources/Destinations/Pairs
Source and/or destination autonomous system(s)
Number of exporters the source, destination, or pair was observed on
Total number of flows with data associated with the autonomous system(s)
Average packet rate for activity involving the autonomous system(s)
Average data transfer rate for activity involving the autonomous system(s)
IP Groups - Sources/Destinations/Pairs
Source and/or destination IP group(s)
Number of exporters the source, destination, or pair was observed on
Total number of flows with data associated with IP group(s)
Average packet rate for activity involving the IP group(s)
Average data transfer rate for activity involving the IP group(s)
Countries - Sources/Destinations/Pairs
Source and/or destination country/countries
Number of exporters the source, destination, or pair was observed on
Total number of flows with data associated with the country/countries
Average packet rate for activity involving the country/countries
Average data transfer rate for activity involving the country/countries
Protocols
Number of exporters the protocol was observed on
Total number of flows with data associated with the protocol
Average packet rate for activity involving the protocol
Average data transfer rate for activity involving the protocol
Clicking on an entity in any subtab opens a summary page (similar to the host traffic subview) that contains visualizations of the entity’s activity as well as report shortcuts for deeper investigations.
Note
Shortcut links to manage application definitions, protocol exclusions, and FA algorithm exclusion rules are included in the corresponding subtabs.
Advanced filters
Clicking the Filters button opens a tray where one or more filters can be manually configured.
The following filtering option is available:
Src Host
To apply a filter, expand the filter option/section, and select the criteria to use. Multiple filters and criteria can be applied at the same time to further refine results.
Filter operators
Equal: Returns results that exactly match the specified value.
Like: Returns results that contain the specified search term.
Not Like: Excludes results that contain the specified search term.
An All Active option is also available, allowing filtering across all currently active values for the selected category.
Search#
When host indexing is enabled, the Explore > Search tab can be used to look up hosts that have been seen on the network. Simultaneous searches can be performed for single hosts and/or host pairs (indexing must be enabled separately; see step 7 below).
Hint
The host index search page can be accessed from any other UI view by clicking the search icon/button in the navigation bar.
The following are the available details displayed in the search results:
Host
Traffic direction (inbound, outbound, A > B, B > A, bidirectional)
First and last seen timestamps
Exporter/source of collected data
Bytes in and out
Packets in and out
Flows in and out
To show fewer details in search results, click the table button and untick the checkboxes for the columns to be hidden.
In the search results, drilling into a host will display a summary of its activity on the network. Clicking on a data source opens a tray that allows the user to quickly pivot to any supported report type.
Enabling host indexing#
When host indexing is enabled, Scrutinizer will store records for all hosts that pass traffic on the network. Records for host pairs can also be stored (and searched through) by enabling host to host indexing as indicated below.
Important
When host indexing is enabled, additional resources may need to be allocated to the Scrutinizer collectors as described here.
To enable host indexing:
Navigate to Admin > Alarm Monitor > Flow Analytics Algorithms.
Open the configuration tray for the Host Indexing algorithm.
Click the Enabled toggle to enable host indexing.
Add sources/inclusions for the algorithm either individually or using security groups.
Hint
Recommended inclusions for host indexing are internal/core routers, edge routers, and public IP addresses that have been assigned to IP groups.
Add any sources that should not be indexed (IP addresses/ranges, domains (by reverse DNS), IP groups, etc.) as exclusions.
Click on Settings and edit the following host indexing options if necessary:
Host index data retention duration
Host index database location
Path to host indexing domain socket
Maximum size of host index database
Host index sync interval
Maximum number of records per update
[Optional] Click the Host to Host Indexing toggle to enable host-to-host/host pair indexing.
[Optional] If host-to-host indexing is enabled, specify the location for the database if necessary.
Click Apply to save the updated settings.
Once the algorithm has been configured and enabled, the host (and host-to-host, if enabled) index database will start being populated.
Hint
If the Use Host Index option (Admin > Settings > Reporting) is enabled, only exporters that a host has been seen on will be searched when data is aggregated for a report. This can significantly reduce the time it takes to run reports.
Populating the host index database from historical data#
If host indexing is not immediately enabled after Scrutinizer is deployed, the database can be backfilled using historical data.
To populate the host index database from historical tables, follow these steps:
View instructions
SSH to the Scrutinizer server as the
plixeruser.Stop the host index service:
sudo systemctl stop scrutinizer-host-indexRun the following to populate the database using the specified historical data tables and time range/window:
host_index --db_config --verbose --populate_from_history --table_interval=INTERVAL_TABLE --date_start="<START_DATE_TIME>" --date_end="<END_DATE_TIME>"
where:
START_DATE_TIMEandEND_DATE_TIMEmust be formatted asYYYY-MM-DD HH:MM, with the time in 24-hour format (leading zeroes should be omitted).INTERVAL_TABLEis an integer that specifies the aggregation interval tables and should be set to1,5, or30.
Note
If the time element is omitted from
END_DATE_TIME, data from the end date specified will be excluded from the operation.The utility can also be used to repopulate the host index database in case of data corruption. However, it is highly recommended to contact Plixer Technical Support for assistance with restoring data.