How does sentinel report calculate KPI?

Dear Friends,
I have a requirement about KPI, I ever achieved it through
ArcSight, But I don`t know if Sentinel can achieve the need(now I am
working in Novell) , ArcSight collect IPS events, Customer need a report
to summary monthy security event score by priority, requirement is
following, how does arcsight implement? at first, building a active list
table included following information, then building a query, the query
surpport to build variable and reference active list and the variable
used query fields to calculate Score, Then building a Trend to invoke
the query and schedule daily 2:00 exclude, report invoke the trend to
implement monthly report KPI Score, How to implement it via Sentinel?
Priority Desc NewPriority Weight Event Count(Monthly) Score
Very High 0.004 50% 4000
8.000000
High 0.0005 20% 30000
3.000000
Medium 0.0001 15% 15000 0.225000
Low 0.00005 10% 10000
0.050000
Very Low 0.000001 5% 10000
0.000500
KPI Value 88.72
Security Health Good
KPI Value = 100-SUM(Priority * Weight * Event Count)
steve_zeng
steve_zeng's Profile: https://forums.netiq.com/member.php?userid=3875
View this thread: https://forums.netiq.com/showthread.php?t=46741

Could you provide a few examples of the data going into this report?
Also, could you explain the business case provided by this report and how
it will help the organization? Often knowing the business case and how
the data are used can help with the creation of the correct reports.
Sentinel already comes with several reports of events by severity, and has
the capability of acting in certain ways based on event data depending on
if the affected system(s) are high priority (e.g. user-facing production
website) or lower priority (e.g. development workstation) which may be
what you are after.
Good luck.

Similar Messages

How does Mac OS calculate the charging Cycle count?

Hello, Guys
How does Mac OS calculate the charging Cycle count? I just used my MBP for about 15 min without power plugged in and I saw it left about 90% battery. However after the battery be recharged, I checked system profiler. It shows charging cycle count increased 1. I do remember that last time I left almost the same percentage of battery and plugged in. After the battery was fully charged, profiler did show cycle count increased.
So I am wondering How does Mac OS calculate the charging Cycle count? Basing on the percentage left or something else?
Thanks,

Ok,
But does it count continuously or separatly? I mean One time I used 10% and recharged full; and next time I used 20% and fully recharged again. Does the OS increase the cycle count when the usage adds up to 100% no matter how many times of recharge?
Thanks,

How does the system calculate nondeductible taxes?

Dear Gurus,
How does the system calculate nondeductible taxes?
Thanks..

The sytem calculates the Taxes based on the Tax rates maintained in a tx code, the Caluctaion is based on the taxing procedure assigned to the Country.
Non deductible tax is identified based on the Account key assigned to the Condition type in the Taxing procedure.
The Non deductible tax Account keys are
NAV - Non-deduct.input tax ( This will distribute the tax into a new line item)
NVV - Non-d.input tax dist ( this will Distribute to relevant expense/revenue items )

How does the system calculate taxes?

Dear All,
How does the system calculate taxes?
Can anybody explain in detail how the values will flow from PB00 / PBXX to BASB ?
Is this flow will remains same in both deductible & non deductible taxes ..??
Pls explain
With Regds

Hi
Just remove the base type 362 in the taxing procedure & check if your tax is calculating or not.
The Tax determination still works.
FORM FRM_KOND_BASIS_362.
*Application country specific
*This alternate base value is to be attached to BASB. This routine
*fetches KZWI6 captured in the pricing procedure.
Thanks & Regards
Kishore

How does one report bugs to Apple re iOS 6?

So many things are going wrong since the update ... How does one let Apple know? (not feedback)

At the feedback website (http://www.apple.com/feedback) under feedback type select "Bug Report". That is the official way to submit a bug report.

How does AnyConnect client calculate its Link Speed? (Windows 7)

I'm curious about how the AnyConnect client determines what its default Link Speed is, upon initialization?
For example, from behind my home firewall, if I have a client that's physically connected to a 1Gbps uplink, when I launch the AnyConnect client, Windows Task Manager shows me a Link Speed of 9 Mbps for my AnyConnect connection.
However, if I also launch an AnyConnect connection from another machine on my home LAN, connected via 300Mbps WiFi, Windows Task Manager will only show me around a 1 Mbps Link Speed.
How does the AnyConnect client calculate its Link Speed upon connection?   Does it take a percentage of the available upstream bandwidth?
My home ISP bandwidth is 50Mbps down/12 Mbps up.   My corporate ISP (where the ASA I'm connecting to resides) it 50Mbps bi-directional.

For PHP, if you want to handle data in UTF8, NLS_LANG must be set to
"<language>_<territory>.UTF8", where <language> and <territory> are your
preference. There is few difference between ODBC and OCI called by PHP
in this case as both need to set NLS_LANG to UTF8. If you are familiar
with OCI and expect better performance, you can do so. But if you want
to make the application be portable in terms of data source, ODBC is an
appropriate choice.
Data source doesn't matter the encoding of client. The character set of
client is determined by how client calls ODBC functions SQLBindParameter
or SQLBindCol. If the client specifies SQL_C_WCHAR, data is exchanged in
UTF-16 independent from NLS_LANG. If it is SQL_C_CHAR, data is in
NLS_LANG encoding. Unicode ODBC client binds data with SQL_C_WCHAR, that
is exactly the case of MS Access 2000. On the other hand, because PHP
binds data with SQL_C_CHAR, NLS_LANG is taken as the encoding for data
manipulations

How does the system calculate the Taxes?

Dear all friends,
How does the SAP system calculate the Taxes?
pls. explain with the example will be highly appreciable.
thanx in advance to all
best regards,
Rajesh

Hello
The SAP system calculates tax based on the tax calculation procedure assigned to your country in OBBG.
The tax calculation procedure is similar to the pricing procedure in materials management.
As you have different pricing elements like gross price,discounts,freight charges, etc in pricing procedure, you will have different tax elements like Excise duty,Special excise duty,Cess,Edu cess,VAT,CST, etc in tax calculation procedure.
At the time of PO creation, the tax base amount is communicated to the tax calculation procedure from the pricing procedure.
And the tax values are calculated based on that and how you have configured your tax calculation procedure.
In CIN, we have two tax calculation procedures
TAXINJ which can be formula based or condition based and TAXINN which is condition based.
In TAXINN, the tax percentages are picked from the condition records maintained.
But in TAXINJ, it can be either from the condition records or the tax % given in the tax codes in FTXP. It depends on how you configure your system.
Hope this helps
Regards
Gregory Mathews

How does one report app fraud?

There is an app for Pads currently appearing as the first choice for "Geocaching" that is not what it appears to be. The app is using the Geocaching.com's logo and is selling for a "bargin" price. It is very obviously not connected with Geocaching.com, but is possibly doing other harm. How is this reported and how does it get action taken against it?

To Contact iTunes Customer Service
Use this Link > Apple Support iTunes Store Contact

How does the CBO calculate the selectivity for range predicates on ROWID ?

Hi all,
I'm wondering how the CBO estimate the selectivity for range predicates based on ROWID columns.
For example, for the following query the CBO estimates there's going to be 35004 rows returned instead of 7:
SQL> SELECT count(*)
FROM intsfi i
WHERE
ROWID>='AAADxyAAWAAHDLIAAB' AND ROWID<='AAADxyAAWAAHDLIAAH'; 2    3    4
COUNT(*)
         7
Elapsed: 00:00:02.31
SQL> select * from table(dbms_xplan.display_cursor(null,null,'iostats last'));
PLAN_TABLE_OUTPUT
SQL_ID aqbdu2p2t6w0z, child number 1
SELECT count(*)   FROM intsfi i WHERE ROWID>='AAADxyAAWAAHDLIAAB' AND
ROWID<='AAADxyAAWAAHDLIAAH'
Plan hash value: 1610739540
| Id | Operation             | Name    | Starts | E-Rows | A-Rows |   A-Time   | Buffers |
|   0 | SELECT STATEMENT      |         |      1 |        |      1 |00:00:02.31 |   68351 |
|   1 | SORT AGGREGATE       |         |      1 |      1 |      1 |00:00:02.31 |   68351 |
|* 2 |   INDEX FAST FULL SCAN| INTSFI2 |      1 | 35004 |      7 |00:00:02.31 |   68351 |
Predicate Information (identified by operation id):
   2 - filter((ROWID>='AAADxyAAWAAHDLIAAB' AND ROWID<='AAADxyAAWAAHDLIAAH'))According to Jonathan Lewis' book, for a normal column the selectivity would have been:
(value_column1-value_column2)/(high_value-low_value)+1/num_distinct+1/num_distinct
But here with the ROWID column, how does the CBO make its computation ?
SINGLE TABLE ACCESS PATH
Single Table Cardinality Estimation for INTSFI[I]
Table: INTSFI Alias: I
    Card: Original: 14001681.000000 Rounded: 35004 Computed: 35004.20 Non Adjusted: 35004.20

Hi Jonathan,
Some Clarifications
=============
DELETE /*+ ROWID(I) */ FROM INTSFI I WHERE
(I.DAVAL<=TO_DATE('12032008','DDMMYYYY') AND (EXISTS(SELECT 1 FROM
INTSFI S WHERE S.COINT=I.COINT AND S.NUCPT=I.NUCPT AND S.CTSIT=I.CTSIT
AND NVL(S.RGCID,-1)=NVL(I.RGCID,-1) AND S.CODEV=I.CODEV AND
S.COMAR=I.COMAR AND S.DAVAL>I.DAVAL) AND I.COMAR IN (SELECT P.COMAR
FROM PURMAR P WHERE P.NUPUR=1))) AND ROWID>='AAADxyAAWAAHDLIAAB' AND
ROWID<='AAADxyAAWAAHDLIAAH'
Plan hash value: 1677274993
| Id | Operation                      | Name    | Starts | E-Rows | A-Rows |   A-Time   | Buffers | OMem | 1Mem | Used-Mem |
|   0 | DELETE STATEMENT               |         |      1 |        |      0 |00:00:05.94 |   53247 |    |          |          |
|   1 | DELETE                        | INTSFI |      1 |        |      0 |00:00:05.94 |   53247 |    |          |          |
|* 2 |   HASH JOIN SEMI               |         |      1 |   9226 |      7 |00:00:05.94 |   53180 |   783K|   783K| 471K (0)|
|   3 |    NESTED LOOPS                |         |      1 |   9226 |      7 |00:00:00.01 |      10 |    |          |          |
|* 4 |     TABLE ACCESS BY ROWID RANGE| INTSFI |      1 |   9226 |      7 |00:00:00.01 |       6 |    |          |          |
|* 5 |     INDEX UNIQUE SCAN          | PURMAR1 |      7 |      1 |      7 |00:00:00.01 |       4 |    |          |          |
|   6 |    INDEX FAST FULL SCAN        | INTSFI1 |      1 |     14M|   7543K|00:00:01.73 |   53170 |    |          |          |
Predicate Information (identified by operation id):
   2 - access("S"."COINT"="I"."COINT" AND "S"."NUCPT"="I"."NUCPT" AND "S"."CTSIT"="I"."CTSIT" AND
              NVL("S"."RGCID",(-1))=NVL("I"."RGCID",(-1)) AND "S"."CODEV"="I"."CODEV" AND "S"."COMAR"="I"."COMAR")
       filter("S"."DAVAL">"I"."DAVAL")
   4 - access(ROWID>='AAADxyAAWAAHDLIAAB' AND ROWID<='AAADxyAAWAAHDLIAAH')
       filter("I"."DAVAL"<=TO_DATE(' 2008-03-12 00:00:00', 'syyyy-mm-dd hh24:mi:ss'))
   5 - access("P"."NUPUR"=1 AND "I"."COMAR"="P"."COMAR")
When I force the NESTED LOOP SEMI JOIN the query runs faster:
DELETE /*+ ROWID(I) */ FROM INTSFI I WHERE
(I.DAVAL<=TO_DATE('12032008','DDMMYYYY') AND (EXISTS(SELECT /*+ NL_SJ
*/ 1 FROM INTSFI S WHERE S.COINT=I.COINT AND S.NUCPT=I.NUCPT AND
S.CTSIT=I.CTSIT AND NVL(S.RGCID,-1)=NVL(I.RGCID,-1) AND S.CODEV=I.CODEV
AND S.COMAR=I.COMAR AND S.DAVAL>I.DAVAL) AND I.COMAR IN (SELECT P.COMAR
FROM PURMAR P WHERE P.NUPUR=1))) AND ROWID>='AAADxyAAWAAHDLIAAB' AND
ROWID<='AAADxyAAWAAHDLIAAH'
Plan hash value: 2031485112
| Id | Operation                      | Name    | Starts | E-Rows | A-Rows |   A-Time   | Buffers |
|   0 | DELETE STATEMENT               |         |      1 |        |      0 |00:00:00.01 |      94 |
|   1 | DELETE                        | INTSFI |      1 |        |      0 |00:00:00.01 |      94 |
|   2 |   NESTED LOOPS SEMI            |         |      1 |   9226 |      7 |00:00:00.01 |      27 |
|   3 |    NESTED LOOPS                |         |      1 |   9226 |      7 |00:00:00.01 |       9 |
|* 4 |     TABLE ACCESS BY ROWID RANGE| INTSFI |      1 |   9226 |      7 |00:00:00.01 |       5 |
|* 5 |     INDEX UNIQUE SCAN          | PURMAR1 |      7 |      1 |      7 |00:00:00.01 |       4 |
|* 6 |    INDEX RANGE SCAN            | INTSFI1 |      7 |     14M|      7 |00:00:00.01 |      18 |
Predicate Information (identified by operation id):
   4 - access(ROWID>='AAADxyAAWAAHDLIAAB' AND ROWID<='AAADxyAAWAAHDLIAAH')
       filter("I"."DAVAL"<=TO_DATE(' 2008-03-12 00:00:00', 'syyyy-mm-dd hh24:mi:ss'))
   5 - access("P"."NUPUR"=1 AND "I"."COMAR"="P"."COMAR")
   6 - access("S"."COINT"="I"."COINT" AND "S"."NUCPT"="I"."NUCPT" AND
              "S"."CTSIT"="I"."CTSIT" AND "S"."CODEV"="I"."CODEV" AND "S"."COMAR"="I"."COMAR" AND
              "S"."DAVAL">"I"."DAVAL")
       filter(NVL("S"."RGCID",(-1))=NVL("I"."RGCID",(-1)))the above post is from Ahmed AANGOUR
Case 1 - . If you check Plan hash value: 16772749938
=====
TABLE ACCESS BY ROWID RANGE| INTSFI For every row access from INTSFI - it fetches a record from INDEX UNIQUE SCAN | PURMAR1
If we check A-rows = 9226
9226 * 7 = 64582 request across the table - perhaps with hint of rowid it fetches exact rows from PURMAR1
in this case i think going for hash join with ordered hints (jonathan as you suggest go for leading hint's instead of ordered) - from INTSFI - PURMAR1 - instead of going for IN clause would get the rows that satifies the ("P"."NUPUR"=1 AND "I"."COMAR"="P"."COMAR")
|* 2 |   HASH JOIN SEMI               |         |      1 |   9226 |      7 |00:00:05.94 |   53180 |   783K|   783K| 471K (0)|
|   3 |    NESTED LOOPS                |         |      1 |   9226 |      7 |00:00:00.01 |      10 |    |          |          |
|* 4 |     TABLE ACCESS BY ROWID RANGE| INTSFI |      1 |   9226 |      7 |00:00:00.01 |       6 |    |          |          |
|* 5 |     INDEX UNIQUE SCAN          | PURMAR1 |      7 |      1 |      7 |00:00:00.01 |       4 |    |          |          |My understanding with above plan would change to
HASH JOIN
TABLE ACCESS BY ROWID RANGE| INTSFI
INDEX UNIQUE SCAN | PURMAR1
HASH JOIN
INDEX FAST FULL SCAN | INTSFI1
Which migt be feasible.
2 .
DELETE /*+ ROWID(I) */ FROM INTSFI I WHERE
(I.DAVAL<=TO_DATE('12032008','DDMMYYYY') AND (EXISTS(SELECT /*+ NL_SJ
*/ 1 FROM INTSFI S WHERE S.COINT=I.COINT AND S.NUCPT=I.NUCPT AND
S.CTSIT=I.CTSIT AND NVL(S.RGCID,-1)=NVL(I.RGCID,-1) AND S.CODEV=I.CODEV
AND S.COMAR=I.COMAR AND S.DAVAL>I.DAVAL) AND I.COMAR IN (SELECT P.COMAR
FROM PURMAR P WHERE P.NUPUR=1))) AND ROWID>='AAADxyAAWAAHDLIAAB' AND
ROWID<='AAADxyAAWAAHDLIAAH'Ahmed AANGOUR, modified the query by /*+ NL_SJ */ hint, Instead of that in to remove the most of the rows as we join the tables using subquery, I still doubt it
to go push_predicate hints - still doubt it.
Jonathan your comments are most valuable in the above two cases..
Looking forward to calrify my understanding with concepts of indexes for above test cases
- Pavan Kumar N

Can anyone let me know how does the system calculate forecast strategy?

Hi all,
I am new in Demand planning,, I can see a couple of Forecast strategy used in the production. I would like to know how does the system does the calculation for the forecasting strategies like
36     Median method
13     Moving average
94     Linear regression
etc.
Can anyone pls guide me how does the system do the calculation and how to validate those calculations!!
Thanks
Pooja

Hi Pooja,
The below link will contain the detailed list of all forecast strategies alongwith how
it will be calculated alongwith the formulas
http://help.sap.com/saphelp_scm70/helpdata/EN/ac/216b6e337b11d398290000e8a49608/frameset.htm
Please confirm whether this helps you to resolve your query
Regards
R. Senthil Mareeswaran.

How does Fin Reports handle #Missing????

I have a dilemna.
I have a expense account 'Office Expense' that has data in it for FY11 Budget of 4K, but for FY12 Budget there is no data so it's #Missing basically.
How can Fin Reports treat that #Missing in formulas?
Logic:
IF FY12 = 0 or #Missing AND FY11 > 0 THEN (FY12 - FY11) * -1
Result Should be:
0 - 4000 = -4000 * -1 = +4000
Is this possible in Fin Reports?

Hi
Have you read the FR studio guide as some of your questions are answered in there?
http://docs.oracle.com/cd/E17236_01/epm.1112/fr_user_epm.pdf
Look at the chapter on Functions, in the IfThen section it talks about:
- IsMissing / IsMiss for coping with #Missing
- IsError / IsErr for coping with formulae that return #Error, e.g. dividing by 0
- IsNonNumeric / IsNN for coping with non numeric values
Hope this helps
Stuart

How does the nano calculate walk duration? It doesn't match finish minus start

I started using the 7th gen nano to track steps during the day. However, the reported duration never matches how long I've been tracking steps. I've had the walk tracker on for 5 hours today, but the reported duration is only 2 hours. I recorded a 15 hour session yesterday, but it only reported just under 8 hours of duration. Is it only reporting the duration it sensed movement? Or is something else going on? I've never seen the duration counter stop ticking, but it's obviously not reporting the difference between start time and end time.

Oops sorry my bad about saying you were averaging averages, just had that on the brain as a client was doing that a little while back which was frustrating. Taken from the stored procedure for that report:
Avg_Handle_Time = (th.totalhandletime / th.callshandled)
FYI:
totalhandletime = sum(tacdr.handletime)
callshandled = count(cqdr.sessionid)
handletime = acdr.talktime + acdr.holdtime + acdr.worktime
Find out how
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
IEX TotalView calculates it's AHT and see if it uses the same calculation
In regards to queuing to multiple CSQs. A call can only be handled in 1 CSQ even if it is queued to multiple. So if a call is queued to CSQs ABC and XYZ, if it is answered via ABC the call disposition (in the ContactQueueDetail table) will be as follows:
ABC: Handled by CSQ (disposition = 2)
XYZ: Handled by another CSQ (disposition = 5)
Cheers,
Nathan

Cash Credit Line: How does it report to CC records?

So here is the run down of what I am trying to do. I am getting married and I have to pay a venue $3,750. However, they do not accept CC payments; it has to be paid with either Check or Money Order. I have the money to pay them with a check, but I was wonder if I should do a Cash withdraw from my Bank Of America Cash Rewards card and deposit it into my BOA Checking and pay the venue with a check. Then after the check post and funds are withdrawn deposit cash into my BOA checking and pay off the $3,750 balance on the credit card? Confusing but trying to see if it's worth it, so that BOA Cash rewards credit analysts see high usage?

It would count as a Cash Advance. Historically banks have tended to frown on these from anecdotal reports; personally I would never do that but that's me. No grace period on it typically, doesn't count as a purchase, and tradeline use I consider to be less important than not doing something which a lender may just not like for whatever reason. I don't know how BOFA looks at them explicitly, maybe it's OK, but I sort of view it as leaving a loaded revolver in a room full of 3 year olds. Write the check imo.

How does a report execute on Server

Hi,
we are using reports 6i,j2ee application ... i create reports in RDF format files which will generate output in PDF format ... when i execute in report builder
i cant see the difference of PDF output or normal report output .Then i deploy them in the server drive .These reports are executed from j2ee application and displays
the application in PDF Format .
Today my lead asked to execute one report and show ..when i executed i got the output in Report Builder ..but he wants to see how the Users see the output on the screen not on the report builder ...how can we do that ...
please anyone reply for this question

Sorry all i posted it on wrong forum

How Does One Report ThinkVantage Software Problems to Lenovo

Per the subject line, how? If you click the ThinkVantage Technologies link at this URL:
http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=YAST-3P2QYL&sitestyle=lenovo
you get the IBM support center, and they only handle hardware issues. I have a call in to the IBM supervisor to bring resources to bear from that end, but how to attack this from the Lenovo end?
FYI, my problem is with the Windows XP Control Panel Power Options. If I set the System Standby option when on battery to 30 minutes, suspend the PC (Fn-F4) and then resume it, this option is then blank and the PC will never suspend automatically when on battery. I removed the ThinkVantage Power Manager and this problem no longer occurred. Before this test, I used System Update and it installed the current version of Power Manager.

Hi,
here is one place, where you can report TT issues.
If you are a company, then there is also an official way, and that is through your contact person, which will directly lead your issue to the appropriate person.
Pelase understand, that TVT Power Manager, if installed , is the primary source, where you should do the changes in Power manager on your system. In case you will change some power settings in Windows power manager, then this might cause confusion and conflict in Power Manager.
Therefore, in case you want to change some power settings on your system and you have TVT Power Manager installed, make sure, that you are using this tool, as after it is installed, it's the primary source for informations.
Cheers

How does sentinel report calculate KPI?

Similar Messages

Maybe you are looking for