This chapter covers recurring concepts when using the web user interface of the Greenbone Security Manager. This includes standard icons, Powerfilters, tags and the graphics in the Secinfo dashboard.
The web user interface uses recurring icons for the execution of identical actions. The reference of these icons results from the context of the current view.
Other icons can only be accessed in a certain context. This applies to the following icons:
The charts in the SecInfo dashboard can be customized. This allows to display and format the SecInfo data in different ways. The created graphs can be downloaded and included into other documents.
There are four different chart types available:
The contents of the charts can be selected via the drop down menu at the bottom of the chart. This immediately also changes the chart type automatically. Downloading the pictures or a copy can be selected through the context menu at the top left of the chart.
Almost every screen in the web user interface offers the possibility to filter the information displayed. The required entries can be performed in the filter bar at the top of the web user interface.
Thereby the Powerfilter is context aware again. Should NVTs or targets being filtered more or less options are available respectively after expanding.
The Powerfilter is not case sensitive.
A typical Powerfilter search could search for all CVE-2009-2906 vulnerabilities within the 192.168.155.0/24 network.
The possible components of the Powerfilter depend on its context. In general the specification of the following parameters is always possible:
-1will display all results. Entering a value of
-2will use the value that was pre-set in My Settings under Rows Per Page.
Defines the column that should be used for sorting the results (sort=name). The results are being sorted ascending. The name of the column can mostly be deducted from the name of the column. By clicking the column the name of the column can be verified. Typical column names are:
The column names will be changed to small caps and spaces to underscores. Additionally a couple of other fields are available.
By filtering using tags custom categories can be created and used in the filters. This allows for versatile and granular filter functionality!
When specifying these components many operators can be used:
There are a couple of special features. If the value is omitted after the equal sign all results will be displayed where this value is not set:
shows all results without a comment.
If the column that should be searched is omitted all columns will be searched:
This searches if at least one column contains the search string.
The data is usually or combined.
This can be specifically specified with the key word
To achieve an and-combination the keyword and needs to be specified.
Using not will negate the filter.
Date specifications in the Powerfilter can be absolute or relative. An absolute data specification has the following format:
The time can be omitted:
The time of 12:00am will be assumed automatically. The date specification can be used in the search filter i.e. created>2014-05-26.
Relative time specifications are always calculated in relation to the current time. Positive time specification are interpreted as being in the future. Time specification in the past are defined with a prepended minus (-). For time periods the following letters can be used:
To view the results of the past 5 days enter -5d. A combination 5d1h is not permitted. This is to be replaced with 121h respectively.
To limit the time period , i.e. month, for which information should be displayed the following expression can be used:
modified>2014-06-01 and modified<2014-07-01
In general, additionally text phrases that are being searched for can be specified. Then only results are being displayed in which the text phrases where found. If the text phrases or not limited to a column (name=text) all columns will be searched. This means that also columns that are hidden from the current view will be searched as well.
The following examples can be useful:
overflow. This applies to both
Overflowas well as
192.168.0.1as well as
exploit. Of course results that contain both words will be displayed as well.
remote and exploit
Interesting and often used filters can be saved as well. This simplifies their re-use. For example, to display the NVTs that were modified or added to the feed last week, in the GUI select SecInfo Management followed by NVTs. Then edit the Powerfilter so that it has the following content (see figure Often used Powerfilters can be saved and retrieved again.):
Created>-1w or modified>-1w sort-reverse=created rows=1 first=1
This displays all the NVTs that were created or modified last week. This filter can now be given a name. Use the field to the right of the Powerfilter. Enter the name and confirm with . The filter is now being saved and can be selected via the drop down box next to it.
To use a previously saved filter use the drop down box and confirm afterwards by clicking Switch Filter (see figure The filters can be selected via the drop down box.). If Java script is activated the filter is executed immediately after selection from the drop down box.
If a specific filter should always be activated in a specific view it can be done in the user settings (see also chapter My Settings). In this example (see figure Often used filters can be set up as default filter in the user settings.) it is the NVT Filter.
All saved filters can be managed in Configuration/Filters. Here, filters can be deleted, edited, cloned and exported as GSM object for import into other appliances.
These filters can then be used to filter results of events for the alerts as well.
Filters can be shared.