Documentation Nexus IQ Server 1.17

Our documentation site has moved. For the most current version, please see http://help.sonatype.com

9.1. Using the Dashboard

Once logged into the Nexus IQ Server, the Dashboard will display by default. If you are in any other location of the Nexus IQ Server, simply click the Dashboard icon figs/web/clm-server-dashboard-icon.png located in the header.

[Note]

The Dashboard is only available via the Nexus IQ Server, and only displays information for applications you are permitted to see. This requires that you, at a minimum, be in the Developer role for at least one application.

Data displayed here is based primarily on violations found during the evaluations of your applications. It is organized into three distinct areas:

  • Filters
  • Visual Overview
  • Highest Risk Violations
figs/web/clm-server-dashboard-default-display.png

Figure 9.2. Using the Dashboard


[Note]

When navigating the Dashboard, clicking on the breadcrumb link will return you to the most recent tab.

9.1.1. Filters

Filters allow you to adjust the data that is displayed in the Dashboard. While this gives you greater control over what is viewed, in some cases this may limit the display of certain information.

scale=50

Figure 9.3. Dashboard Filter Example


This is most apparent with regard to the display of threat level ranges (Critical, Severe, Moderate, and Low). Based on what filters are set, any columns that display this data may be completely hidden from view.

For example, by default the threat level filter is set to exclude any violations of policies with a threat level less than or equal to 1. Given this, the low threat level column will not be displayed.

The Filter icon is located to the left of the Nexus IQ Server screen, just below the Sonatype logo. To edit the various filters that are available, click on the chevron to the right of the Filter icon figs/web/clm-server-dashboard-filter-icon.png. This will cause the Filter menu to slide out to the right.

[Note]

To close the Filter menu, click the chevron next to the Filter icon.

With the Filter menu open, make selections using the five available filters, and then click the Apply button. Any filters that are not set to All, will have a blue circle, with the total count of selected filter options.

For example if you selected five applications, the Applications filter would have a blue circle with the number five. The same is true with all the filters, including threat level. In the case of the latter, the total number of threat levels selected in the filter, not the actual threat level, is displayed.

To reset the filters, click the Reset button, and then Apply.

figs/web/clm-server-dashboard-filters.png

Figure 9.4. Filtering the Dashboard


[Tip]

After exiting the Sonatype Dashboard area and/or logging out, your most recent filters will persist for your account when you return.

The available filters have been described below.

Applications
The application filter allows you to select which applications you want displayed in the violation lists.
Application Tags
The tag filter allows you to isolate violations for applications associated with a particular tag.
Policy Type

The policy type filter allows you to select which types of policies you want displayed in the violation lists. Type is assigned automatically based on conditions included within the policy. The following rules are used to determine a policy’s type:

Security
if there are any security conditions, it is considered a security type policy.
License
if there are any license conditions, it is considered a license type policy.
Quality
if there are any age or popularity conditions, it is considered a quality type policy.
Other
if there are any conditions not mentioned above, it is considered an other type policy.
[Note]

A policy can only ever be of one type. In cases where a policy has conditions that meet more than one of the rules above, the order above dictates the type of policy. For example, if a policy has security and license conditions, it would be considered a security type of policy.

Stage

Violations can occur in different stages, and this will likely affect how much attention you decide to give at a particular point in time. Using this filter, you can show violations for a specific stage. The available stages include:

  • Build
  • Stage Release
  • Release
  • Operate
[Note]

Access to stages is limited by your product license, and the filters will reflect this. In addition, when specifying a stage with the filter, those not selected will be hidden from view.

Policy Threat Levels

The Policy Threat Level filter functions as a slider that allows you to select the threat level or a range of threat levels. This corresponds to the threat level of the policy that has been violated.

[Note]

By default, the Policy Threat Level filter has already been set to only display policy violations with a threat greater than or equal to 2. This means only those violations in the Critical, Severe and Moderate threat ranges will be displayed. As a result, the Low threat category column is hidden.

9.1.2. Visual Overview

Underneath the Dashboard header there are two visual summaries of the data matching the current filter.

figs/web/clm-server-dashboard-visuals.png

Figure 9.5. Dashboard Visuals


Viewing

While much of the Dashboard focuses on policy violations, the information provided in the Viewing area covers all components. There is only one exception, proprietary components. That is, the match results will not include any components that are excluded as a result of your proprietary component settings.

The first display shows counts for the number of applications, policies, and components the data in the Dashboard represents, identified by their corresponding icon and text label.

figs/web/clm-server-dashboard-visuals-viewing-counts.png

Figure 9.6. Counts


[Note]

In cases where data has been filtered, the counts may not represent all data. This will display as a percentage less than 100%.

The second displays the non-proprietary component matches.

figs/web/clm-server-dashboard-visuals-viewing-match.png

Figure 9.7. Matches


When reviewing match data, it is important to remember the types of matches that can occur. It may also be a good idea to review the section of the Application Composition Report chapter focused on Component Identification. A brief overview is included below.

Exact Match
A component in the application is an exact match for one already known to the Nexus IQ Server.
Similar Match
Portions of the component found in the application may match one already known to the Nexus IQ Server.
Unknown

A component in your application, does not match any components known to the Nexus IQ Server

[Note]

In instances where an unknown or similar component has been claimed, it will be considered an exact match.

Policy Violation Trends

To the right of the Dashboard header is a button titled Calculate Trends, clicking this will open a modal which will retrieve a view of trends for policy violations matching your current filter.

[Note]

This could take some time to calculate depending on the number and size of evaluations that match.

In contrast to the count and match data, the rest of the Dashboard, including the Policy Summary visualization, is geared towards identifying which components in your applications present risk so you can address them accordingly. This is because understanding how your business is handling risk over time is extremely important. As you are likely already asking, questions such as "How many new violations have been encountered, waived, or fixed," as well as "How many remain unresolved," are just the beginning.

Given this, the main goal of the Policy Summary visualization is to provide a quick, twelve-week look at how risk is entering your applications, and how you are handling that risk.

The Policy Summary area is divided into four categories, with each category having four metrics over a twelve-week period.

figs/web/clm-server-dashboard-visuals-summary.png

Figure 9.8. Policy Violation Trends


These categories and metrics have been described below:

Trend Categories
Pending

A policy violation that has been Discovered, but not yet Fixed or Waived, is Pending.

[Tip]

Reducing the number of pending violations is a critical task. Weekly deltas above the x-axis indicate there were more discovered violations than those fixed; green bars below the x-axis represent more violations were fixed than discovered.

Waived

This represents a count of policy violations that have been waived. This count is not included in Pending or Fixed, but is included in Discovered.

[Note]

For more information on waivers, see the Waivers section of the Application Composition Report chapter.

Fixed

A policy violation is Fixed when it no longer exists in any stage.

[Note]

When determining the Fixed state of a component, any filtered stages are not considered. That is, if you exclude a stage where a violation has occurred, the count for fixed may increase even though the violation is still present in the other stage.

Discovered
A policy violation is considered Discovered when it has been observed for the first time.
Policy Summary Metrics
Count
the total (all-time) count for the category.
AVG
the average age of violations in the category
90%
indicates 90 percent of violations have been in the category less than this time.
Delta
the count for the current week (week twelve), over the first week.
Weekly Deltas
the visual representation of each week’s unique delta.
12 Week Trend
the trend over twelve weeks.
[Tip]

It is not uncommon to see discovered violations trend upwards steeply, especially in the early phases of your implementation, and then plateau as you start developing a better component consumption process. Using your mouse to hover over values in the graphs will display the individual values for each week.