Kaspersky Next XDR Expert

Graph

Graph type. The following graph types are available:

• Bar chart.
• Pie chart.
• Counter.
• Table.

Correlator

Name of the correlator that contains the context table for which you want to receive information.

SQL query field

This field lets you manually enter a query for filtering and searching context table data. By default, for each widget type, the field contains a query that obtains the context table schema and the key by key fields.

The query structure is similar to that used in event search.

When creating a query based on context tables, you must consider the following:

• For the FROM function, you must specify the `records` value.
• You can get data only for the fields specified in the context table schema.
• You can use supported features of ClickHouse.
• If you want to receive data for fields whose names contain spaces and Cyrillic characters, you must also enclose such names in quotes in the query:
  • In the SELECT function, enclose aliases in double quotes or backticks: "<alias>", `<another alias>`;
  • In the ORDER BY function, enclose aliases in backticks: `<another alias>`
  • Event field values are enclosed in straight quotes: WHERE DeviceProduct = 'Microsoft'
• Names of event fields do not need to be enclosed in quotes.
• If the name of an active list field begins or ends with spaces, these spaces are not displayed by the widget. The field name must not contain spaces only.
• If the values of the active list fields contain trailing or leading spaces, it is recommended to use the LIKE '%<field value>%' function to search by them.
• You can use the _count service field (how many times this record has been added to the context table), as well as custom fields.
• The metric and value aliases in SQL queries cannot be edited for any type of active lists analytics widget, except tables.
• If a date and time conversion function is used in an SQL query (for example, fromUnixTimestamp64Milli) and the field being processed does not contain a date and time, an error will be displayed in the widget. To avoid this, use functions that can handle a null value. Example: SELECT _key,fromUnixTimestamp64Milli(toInt64OrNull(DateTime)) as Date FROM `records` LIMIT 250.
• Large values for the LIMIT function may lead to browser errors.
• If you select Counter as the chart type, you must specify the method of data processing for the values of the SELECT function: count, max, min, avg, sum.

Special considerations when using aliases in SQL functions and SELECT statements: you may use double quotes and backticks: ", `.
When using spaces or non-Latin characters, the alias must be enclosed in double quotes: "<Alias with a space>", values must be enclosed in straight single quotes: '<Value with a space>'.
When displaying data for the previous period, sorting by the count(ID) parameter may not work correctly. We recommend sorting by the metric parameter. For example, SELECT count(ID) AS "metric", Name AS "value" FROM `events` GROUP BY Name ORDER BY metric ASC LIMIT 250.

Y-min and Y-max

Scale of the Y axis.

Negative values can be displayed on chart axes. This is due to the scaling of charts on the widget and can be fixed by setting zero as the minimum chart values instead of Auto.

Name

Name of the widget.

Color

The color used for displaying the information:

• default for your browser's default font color
• green
• red
• blue
• yellow

Show total

Shows sums total of the values.

Show nulls in legend

Displays parameters with a null value in the legend for analytics. The toggle switch is turned off by default.