Endpoint Application Control Key Performance Indicators Widget

Views:

This widget displays Endpoint Application Control key performance indicators based on selected criteria, and includes customizable templates for applications detected for the first time, applications not in the Certified Safe Software list, average agents stopped, average endpoints not connected, block and lockdown rule.

Figure 1. KPI Widget Example

By default, the widget marks events as "Important" () at 5 occurrences and "Critical" () at 10 occurrences. Optionally, mark events as Important or Critical by customizing event thresholds.

See table Add or Edit Indicator Tasks.

Go to Dashboard and then select Widget Settings from the menu on the top-right of the widget to do the following tasks:

Table 1. KPI Widget Configuration Tasks
Task	Steps
Edit indicator trend calculation used by the widget.	The widget displays trends in the Change column. The widget calculates indicator trends by comparing the current period with an average of previous periods. Under Trend Calculations, type a number of previous periods to average. The default setting is 1.

Go to Dashboard, locate this widget, and then click Edit to do the following indicator-related tasks. After completing tasks, click Done.

Table 2. KPI Widget Indicator Tasks
Task	Steps
Add new indicator.	Click Add Indicator. The Add Indicator screen appears. Select a template, optionally customize settings, and then click Save. See table Add or Edit Indicator Tasks.
Edit indicator.	Click the indicator in the list. The Edit Indicator screen appears. Customize settings, and then click Save. See table Add or Edit Indicator Tasks.
Delete indicator.	Click to the left of the indicator and then click Delete.

Table 3. Add or Edit Indicator Tasks
Task	Steps
Name indicator.	Under Title, type a name. Tip: Leave this field blank to allow Apex Central to name the indicator based on your configuration.
Select template.	Under Template, select a template. See About Templates.
Edit period.	Under Period, select a period for indicator data.
Display threshold icons.	Select Enable thresholds.
Hide threshold icons.	Clear Enable thresholds.
Set "Important" () threshold.	Under Mark events as Important, type the minimum number of event occurrences. The icon displays in the Occurrences column if the following are true: The number of event occurrences that match this indicator is equal to or more than the threshold. Enable thresholds is selected.
Set "Critical" () threshold.	Under Mark events as Critical, type the minimum number of event occurrences. The icon displays in the Occurrences column if the following are true: The number of event occurrences that match this indicator is equal to or more than the threshold. Enable thresholds is selected.

This widget includes customizable templates for the following indicators:

"Template"	"Log type"	"By" Occurrences Aggregated by Data Column	"Period" (Default)
Applications Detected for the First Time	Trusted Applications Important: This data matches the log type "Known applications".		7 days
Applications not in the Certified Safe Software List	Policy Actions		7 days
Average Agents Stopped	Clients Samplings Important: This data matches the data source "Users and Endpoints".		1 day
Average Endpoints not Connected	Clients Samplings Important: This data matches the data source "Users and Endpoints".		More than 1 day in the last 1 day
Block and Lockdown Rule Application Events	Policy Actions	Endpoint Name Name (default) User Name	7 days
Block Rule Application Events	Policy Actions	Endpoint Name Name (default) User Name	7 days
Lockdown Rule Application Events	Policy Actions	Endpoint Name Name (default) User Name	7 days
Uncategorized Applications Detected	Policy Actions		7 days