Pivot Chart

The Pivot chart provides flexible data segmentation and presentation to support complex data analysis. Use the Pivot chart to segment asset fields from different points of view by measuring the asset field values on a desired asset field segmentation and create a visualization with multiple chart representation options such as bar charts, line charts, pie charts, and more.

Configure the Pivot chart by selecting options in the various configuration sections. The available options in each section reflect the configured settings in previous sections. When all required fields are configured, a preview of the chart is displayed in the preview pane to the right. You can click on a chart segment to view a list of related assets in an asset page table. The columns of the table are updated to match the chart configuration.

Work through the following sections to configure a Pivot chart:

1. General
2. Visualization
3. Data
4. Dimensions
5. Metrics
6. Calculation
7. Presentation

For clarity, the following sections demonstrate the creation of a simple Pivot chart, SaaS Application Activity.

1. General

Use General settings to define the name of the chart, add an optional description, and set the type of chart widget.

• Chart title - Enter a descriptive title for the chart.
• Description - Enter an optional description about what the chart shows, the data and/or query it uses, etc.
• Widget - Select Pivot Chart.

In this example, the chart title is SaaS Application Activity. There is an appropriate description and Pivot Chart is selected as the widget.

2. Visualization

The Pivot chart allows you to select from a range of chart types.

Select the chart type that best represents the data you want to see:

• Bar - Shows data in vertical bars to compare values across categories.
• Pie - Visualizes proportions by dividing data into different colored slices, showing how each part contributes to a whole.
• Summary - Shows just the number corresponding to the chart's metric without an added dimension. You can use this option to create Dashboard charts that display one data point.
• Gauge - Shows the value of one measure on a half-circle arc. See Using the Gauge View.
• Stacked - Displays bars divided into segments to represent different asset groups or other segmentation.
• Line - Connects data points with lines to show trends or changes over time.
• Table - Organizes data into a table format, making it easier to analyze relationships or comparisons.
• Map - Displays the geographic location of assets on a map. See Using the Pivot Chart Map Visualization.

In the example above, Stacked is selected as the chart visualization and it segments the data by a particular field. A total of all found assets appears at the end of the bar, while each stacked section of the bar represents a segment of data.

The following sections will describe how to select the various data, metrics, and calculations that will determine what data to display and how.

3. Data

Use the Data settings to select the query that determines the data that is displayed on the chart.

• Under Module, select an asset module and a query. You can also click + Add Query at the bottom of the list to create a new query. See Creating Queries with the Query Wizard for more about creating queries.

• Under Schema, select whether to use current or historical data in the chart:

  • Latest data - Use data from the latest fetch. Aggregates data by the asset Date field.
  • Data over time (snapshots) - Use data from historical snapshots. When some modules, such as Adapter Fetch History or Activity Logs, are selected, this option is not available.

• Show results for previous date - Only available when Latest data is selected. Toggle on to choose a specific fixed date or a date relative to the current date. See Viewing Query Results from a Historical Date.

For this example, SaaS Applications is selected as the module and the query is left empty to include all SaaS applications. This will return data about all SaaS applications. In addition, under Schema, Latest data is selected to use data from the most recent fetch.

4. Dimensions

Select the data segmentation to be represented on the axis. Data from the query in the Data section will be segmented according to the field selected here.

Under Axis, select an adapter and field.

• Click the filter icon to filter the data returned by the selected query. When a filter is applied, a red dot appears on the filter icon. To clear the filter, click the icon, and then Clear and Save.

• Click the edit icon to assign a custom name to the axis. This is useful when you want a more representative name than the field name itself. When a custom name is applied, a red dot appears on the pencil icon. To clear the custom name, click the icon, and then Clear and Save. For Date fields, this functionality also allows for editing how the date is aggregated and displayed. For more information see Editing Date Fields below.

• Click the add icon to add another axis dimension. If the selected chart type doesn't support multiple dimensions, this will be disabled.

For this example, the field Name is selected. This means that data will be segmented by SaaS application name and the axis label adjacent to each bar will be the name of the corresponding SaaS application name. The chart below shows axis labels for the SaaS applications: Zoom, ServiceNow, Okta, and Azure.

The values represented by the bars and that appear to the right of them are determined by the next two settings, Metrics and Calculation.

The amount of data that can be displayed per dimension, depends on how many dimensions are selected in the chart: 1 Dimension - Up to 1,000,000 dimension rows or

See Editing Number and Date Fields.

5. Metrics

Select the values within the Dimensions selected above that you want to count or total in the chart.

• Select an adapter and a field. Some chart types allow you to select multiple measures.

• Select a calculation function for the measure. For more information, see the Calculation section below.

• Specify a color for the measure to be displayed in. This functionality is supported in Bar, Stacked Bar, and Matrix chart visualizations. The option is only displayed when the Set Threshold Color toggle is set to Off.

• Click the filter icon to filter the data returned by the selected query. When a filter is applied, a red dot appears on the filter icon. To clear the filter, click the icon, and then Clear and Save.

• Click the edit icon to assign a custom name to the measure. This is useful when you want a more representative name than the field name itself. When a custom name is applied, a red dot appears on the pencil icon. To clear the custom name, click the icon, and then Clear and Save.

• Click to add another measure. If the selected chart type doesn't support multiple measures, this will be disabled.

For this example, the screen below shows five different user statuses selected as the measures in this example. These will return the number of users per status per SaaS application as selected in the Dimensions section above. The chart will display the users per status for each application. Each bar in the chart represents a SaaS application and will be segmented to display the number of users per user account status.

Segment a Complex Field

You can use the Pivot Chart to display data from a complex field, segmented by another field within the same complex field. This allows for more granular analysis and flexibility in how you display your data.

For example, you can display a device's vulnerable software by CVE severity and count the CVE IDs associated with each severity level. This way the segmentation is performed on the Complex Table level.

Counting the Objects of a List

Use a list of objects as a measure to count how many objects the list holds, for example the network interfaces of each device.

Permissions: To add a chart, you need the Dashboards > Charts > Add permission. To edit a chart, you need the Dashboards > Charts > Edit permission.

To count the objects of a list:

1. On a dashboard, click Add Chart and select Pivot Chart.
2. Select the asset type, for example Devices.
3. In Axis, select a field, for example the OS type.
4. In the Measures field menu, click the list itself, for example Network Interfaces. Don't expand the list to select one of its fields.
5. In Function, Field Count is selected. Field Count is the only function for a list of objects.
6. Click Save.

• The chart shows how many objects the list holds for each asset, added up for each dimension value.
• When the dimension is a field of the same list, for example the name of the network interface, the chart counts each object one time, under its own value.
• The count includes all adapters and custom data. When two adapters report the same object, the object counts two times, the same as Field Count on a field of the list.
• The filter of a measure on a list of objects is disabled.
• A list inside the objects of another list isn't available, and neither is the Security Findings asset type.
• The count works on current data and on historical dates.
• When you click a value in the chart, the asset page shows the assets that have the list, with the conditions of the dimensions.

Example: A Devices Pivot chart has the dimension OS: Type and the measure Network Interfaces with Field Count. The chart shows, for example, Windows 3 and Linux 2, which are the numbers of network interfaces of the Windows devices and of the Linux devices. Add a second dimension on the interface name to see the count for each name.

6. Calculation

Select the calculation function you want. The available functions depend on the field type. You can apply a different function to each of the Measures in the Metrics section.

For this example, the Sum function is selected for each measure. This will calculate the total number of users per SaaS application, segmented by user status.

You can mouse over a chart bar to see the segmentation displayed in a tooltip with the total number of users of each status.

The following table describes the calculation functions available for each field type.

• Compare results - Display a comparison between the latest data and data from a previous date. See Comparing Today's Query Results to a Previous Date.
• Include entities with no value - Enable to set a display value for assets that do not have a value for the selected parameters. In the Display Name field, enter the text you want displayed for these assets.

Counting Adapter Connections vs Counting Unique Assets

When using the Count function, you can either count adapter connections or unique assets.

To count the number of adapter connections, select Count under Function in the Metrics section. In general, the count function on shows the number of adapter connections for the selected asset field.

For example, when you filter for a specific asset name and use the Asset Name field with the count function, the Pivot chart shows the number of adapter connections with that asset name.

To show the number of unique assets, even though a given asset may repeat across adapter connections, you can select the Asset field with the Count function. In the same example, when we replace the Asset Name field with the Asset field, the number displayed will represent the number of unique assets with that asset name.

7. Presentation

Use the Presentation options to configure how the data in the chart is presented.

Select a default sort method for the bars, slices, or lines:

• Sort by value or Sort by name - Sort by the values or by the name of the value.

• Segment value - In the Stacked view, sort the bars by the value of one segment. See Sorting Stacked Bars by a Segment.

• Ascending or Descending - Sort in ascending or descending order.

Additional Presentation settings:

• Set threshold colors - Toggle on to set threshold colors. See Setting Threshold Colors. When the Matrix visualization is selected, you can choose the following options for a color threshold:

  • Static - Set the threshold for displaying the fields in the selected colors.

  • Dynamic - Automatically distribute the color intensity from the lowest to highest values in the table.

• Compare results to a previous date - In bar charts, compare today's query results to a previous date. See Comparing Today's Query Results to a Previous Date.
• Use historical data - Set the chart to display results from a relative or fixed historical date. See Viewing Query Results from a Historical Date.
• Show title - Toggle on to show the title of the chart from the Chart title field.
• Show totals - Toggle on to show totals.
• Show total calculation - In the Bar, Pie, and Stacked views, this option is enabled by default. Disable it to hide the total in the chart footer. See Hiding the Total Asset Count.
• Consistent value colors - In the Pie, Donut, and Bar views, enable to show the same value in the same color on every chart. When you set threshold colors, the threshold colors apply and this option has no effect. In the Pie and Donut views, you can also pick a color for each value in Value colors. See Setting Value Colors.
• Axis Maximum - In the Bar view, enable to set the value that fills the full width of a bar. See Setting the Bar Axis Maximum.

• Set maximum segments to display (for bar charts) - Set the maximum number of segment bars to display in the chart. The default minimum is 10. The maximum is 20. When there are more than the set default number of segments, you can aggregate the remaining segments into one by enabling Aggregate remaining segments as ‘Others’. In the Aggregated Segment name field, enter a display name for the aggregation.

  

Sorting Stacked Bars by a Segment

Use Segment value to order the bars of a Stacked chart by the value of one segment, for example to show the departments with the most Critical items first.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission.

To sort stacked bars by a segment:

1. Open the chart wizard of a Pivot chart, and select the Stacked view.
2. Set the data. Add a field in Dimensions Column, or add two or more fields in Metrics.
3. Wait for the chart preview to load.
4. In Presentation, from Sort by, select Segment value.
5. From Select a segment, select the segment that sets the order of the bars.
6. Select Descending or Ascending.
7. Click Save.

• Segment value appears only for the Stacked view, and only when the chart has segments:
  • With a Dimensions Column field, the segments are the column values that the chart preview shows. Others isn't in the list. You can also type a value that the preview doesn't show.
  • With no Dimensions Column field and two or more metrics, the segments are the metric names, as the legend shows them. You can't type a value.
  • With one metric and no Dimensions Column field, Segment value doesn't appear.
• When you select Segment value, the first segment in the list is selected, and the order is Descending.
• Axonius places each bar by the value of the selected segment in that bar. A bar that doesn't have the segment counts as 0. When two bars have the same segment value, the bar total decides.
• If no bar has the selected segment, the chart sorts by the bar total, the same as Sort by value.
• If the chart shows only the top column values and puts the rest in Others, a bar still sorts by its real value of the selected segment.
• A saved segment stays in the list when the chart preview doesn't show it anymore.
• When you change the view, or remove the segments, Sort by goes back to value, Descending.

Example: A Stacked Pivot chart of devices has Department in Dimensions Row and Severity in Dimensions Column. Select Sort by > Segment value, the segment "Critical", and Descending. The department with the most Critical items appears first.

Using the Gauge View

Use the Gauge view to show the value of one measure on a half-circle arc. The Pivot Gauge works like the Gauge view of the Field Summary chart. See Using the Gauge View for the arc, Minimum, Maximum, and Lower is better options.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission.

To configure a Pivot Gauge chart:

1. On a dashboard, click Add Chart and select Pivot Chart.
2. Select the Gauge view.
3. Select a module and, optionally, a query.
4. In Metrics, select one measure and its Function.
5. In Presentation, enter Minimum and Maximum. Optionally, enable Lower is better.
6. (Optional) Enable Set threshold colors and set the ranges. See Setting Threshold Colors.
7. Click Save.

• The Gauge accepts exactly one measure and no dimensions, the same as the Summary view.
• The arc uses the color of the measure. When you set threshold colors, the arc uses the color of the range that contains the value.
• The Gauge doesn't have the Apply background color option.
• The Gauge isn't available for the Monitoring Findings, Activity Logs, and Adapter Fetch History modules.

Example: A Pivot Gauge shows how many devices are missing an EDR agent. Select the query "Devices missing EDR" and the measure Asset with the function Count. Set Minimum to 0 and Maximum to 500, and enable Lower is better.

Timeline Visualization

When using the Timeline visualization, set the following:

• In Aggregate by, select an aggregation time period: Day, Week, Month Quarter, or Year. Query results for weekly, monthly, quarterly, and yearly time periods are aggregated based on the average values for the selected time period. Each data point for weekly aggregation is the average of all daily values since the last weekly period. And each data point for the monthly aggregation is the average of all daily values since the last monthly period. You can choose to exclude date ranges from the displayed range. The legend reflects the time period selected.

  Note

  On the daily aggregation chart, you can click through to the asset list. See Selecting a Table View for more on what data is displayed when you click a chart segment.

  
  

• Y-axis settings - Select the minimum and maximum values for the y-axis.

Setting Timeline Chart y-axis Min/Max Values