Trend is the behavior or occurence that is observed in context of an event or incident over a period of time.
You now have the option to register any metric for trend computation. After you register a metric for trend computation, the trend is computed from that point in time onward.
How does trend computation work?
Once a metric is registered for trend computation, the resultant data for each day is captured for that metric and is stored as a part of security intelligence and analytics job. Trend data is processed for all registered metrics from the day of registration as a part of security intelligence and analytics job. You can view the trend data through the daily trend panel that is created by default for each metric at the time of registration.
You can at any time unregister from trend computation. Once you unregister from trend computation, all historical data available for that metric and the trend panel gets deleted. You can re-register for trend computation for the same panel.
If a metric has multiple values on the X-axis then the trend panel for this consists of trend lines for each value.
Initially, only the Register for Trend Computation option is available on a right-click. After successful registration the View Trend for <metric_name> and Unregister from Trend Computation option is available in the right-click menu.
Following are the types of charts on which trend computation is not supported:
Trend computation feature can be used for any metric and panel.
Let us assume a metric Distribution of Threats by Type, which is a bar chart. To register this metric for trend computation, right-click and select Register for Trend Computation. A message confirming successful registration is displayed. You must also run the security intelligence and analytics job to generate the trend data.
Right-click either a specific type of threat such as worm, malware, spyware, virus, and so on or anywhere on the grid and select View Trend for Distribution of Threats by Type to display the trend panel that is dynamically created for Distribution of Threats by Type. This trend panel is dynamically named as Distribution of Threats by Type Trend.
What do you see on the trend panel?
For a specific type of threat or all types, depending on what you choose, the computed trend data point on a daily basis is shown in the panel Distribution of Threats by Type Trend.
For example, if you register for trend computation on the 1st of May, the trend computation starts from that point-in-time when you register. If you view the trend panel on the 7th of May, the daily trend data that is available for the past 7 days is plotted in the trend chart. Therefore in this example metric Distribution of Threats by Type, the horizontal axis that is X-axis shows the days and the vertical axis that is Y-axis shows the distinct count of threat identity.
Trend panel behavior
If you right-click a single category on the chart and select View Trend for <metric_name> option you can view the trend for only the selected category.
If you right-click on the grid and select View Trend for <metric_name> you can view the trend for all the available categories.
If there is no data available for a certain period and you view the trend, the message No data found is displayed.
If there is data available for a few days then the data points for only those days are shown when you view the trend.
While viewing the trend, when you right-click and select View details, the details of the most current date are displayed in a grid.
For example, if a chart shows the vulnerability trend of the past 4 days including today, the details drill down will show todays details in a grid.
The trend data gets calculated every time the security intelligence and analytics job runs. The trend metric is based on the daily data.
In order to get daily trend you have to ensure that you fetch data from the data system daily.
In cases where daily data is not present the trend shows grey cross marks for days on which the data is not available. The trend line continues when the data is available.