Field Segmentation Chart

The Field Segmentation chart is a single query metric, consisting of a single query and a chosen query field. Use this chart to present the segmentation of values of the chosen field across the data-set given by the query. You can either see data as a histogram, pie chart, timeline, or table. The timeline graph shows the top 20 assets in the time period defined.

When all required fields are configured, a preview of the chart is displayed in the preview pane to the right. You can click on a chart segment to view a list of related assets in an asset page table. The columns of the table are updated to match the chart configuration.

You can assign chart colors to asset count thresholds to easily evaluate the current environment. See Setting Threshold Colors.

To configure a Field Segmentation chart:

As you configure the chart, a preview is created in the left pane.

1. In Chart title, give a title to your chart.

2. In Description, add a description if you want.

3. From the Widget dropdown, select Field Segmentation.

4. Under Chart presentation select the chart presentation type. The available chart type depends on the module you select.

5. Under Select query, from the Module dropdown, select an asset module.

6. From the Query dropdown, select or create a base query or leave empty for all entities. To learn more, see Chart Query Configuration.

   1. (Optional) To filter the query by any relevant field, click next to the selected query and select the filters you want.

7. From the Segment by drop-down list, select a field by which the results will be segmented.

   1. When you select Table view, you can edit the name of the 'Segment by' field and use another name that better fits your needs. To change the name, click the Edit icon next to the field. When you use a custom name, a red dot is displayed on the Edit icon.
      

8. You can select to have Axonius assign colors to the bar chart automatically from the color palette.

   • To the right of the Segment by list, click the color palette dropdown. Then, near the bottom of the palette, click the rainbow swatch to have Axonius apply color to the bars. See the example below.
   • For Pie and Donut charts, you can also select a color for each value. For Pie, Donut, and Bar charts, you can show the same value in the same color on every chart. See Setting Value Colors.

9. From the Exclude Adapters field, you can select one or more adapters that will not be included in the data used to create this chart. When you hover over the arrow, an x appears. Click the x to clear the adapters in the Exclude adapters list.

10. From the Only from connections field, optionally select one or more adapter connections to count only the field values that come from those connections. See Counting Values from Selected Connections.

11. In the Filter by section, optionally configure one or more predefined filters on all the results of the segmented field.

    • You can create complex filters by using the AND/OR relations, NOT and parentheses. For more details see Working with the query wizard.
    • Each segmented field enables you to select the desired operator based on the selected field type. For more details see Working with the query wizard - Operator drop down section.
    • If the segmented field is a simple field, you will be able to filter only on the segmented field.
    • If the segmented field is a complex field, you will be able to filter on all fields which are part of the complex field.
    • To copy the refinement of the chart's saved query into the filter, click Add Filter and then Use the query's refinement. See Copying the Query Refinement into a Filter.

12. If the bar chart option is selected, define the default data sort. By default, the data is sorted by descending values.
    You can also compare today's query results to a previous date. See Comparing Today's Query Results to a Previous Date.
    To use the same bar scale across several charts, see Setting the Bar Axis Maximum.

13. If you haven't configured a predefined filter, you can select Include entities with no value to ignore entities that don't have a value for the segmented field and therefore won't be included in the chart results.

    • If enabled, you can edit the text displayed in charts when an item has no value to display. By default, the text is 'No Value,' but you can change it to something else, for example, 'None' or 'N/A.'

14. Toggle Case-sensitive segmentation to define whether case will be considered in the data used to create this chart. You can toggle this option off so that the system will ignore the use of case in strings when creating the chart. This means that if the same name is sometimes used with capital letters, and in other cases in lower-case, the system will treat these values as the same value, for instance JOHN, John and JoHn will all be treated as the same value.

    • If enabled, each of these strings will be treated as a separate value, and displayed thus in the chart.
    • If disabled, all strings with the same characters, but different case, are treated as the same value.

15. Set threshold colors - Enable to set different colors for segments that meet or exceed specific asset count thresholds. In the Table view, select Static or Dynamic thresholds. When you set threshold colors, they apply instead of value colors and consistent value colors.

16. You can select Hide Total calculation to hide totals. See Hiding the Total Asset Count for more information.

17. Sorting by - Select how to sort the results in the chart. You can sort by Value, Name, Percentage Change, or Quantity Change, and Descending or Ascending.

    • Percentage Change and Quantity Change are available when Compare results to a previous date is enabled. Percentage Change sorts by the change as a percentage. Quantity Change sorts by the change as a number. With Descending, the values with the largest increase since the comparison date appear first. With Ascending, the values with the largest decrease appear first.
    • The Pie and Donut views also have Sorting by.
    • When you sort by Name, numbers inside names sort by their value. For example, in ascending order, Windows 7 comes before Windows 10. Fields that have their own sort, such as IP addresses and versions, keep it. Existing charts that sort by name can show a new order.
    • When Set maximum segments to display is enabled with a sort by Name, Percentage Change, or Quantity Change, the chart shows the first values in that sort order. For example, with Quantity Change, Descending, and 10 segments, the chart shows the 10 values with the largest change. With a sort by Value, the chart shows the largest values, as before. This change applies to saved charts that use a limit of segments with a sort by name or by change.
    • In the Bar view, you can also select Custom to set the order yourself. See Sorting Bars in a Custom Order.

18. Use historical data - Enable to view query results from a previous date.

19. Compare results to a previous date - Enable to compare current results to results of a previous date. This option is also available for the Pie and Donut views.

20. Set maximum segments to display (for bar charts) - Set the maximum number of segment bars to display in the chart. The default minimum is 10. The maximum is 20. When there are more than the set default number of segments, you can aggregate the remaining segments into one by enabling Aggregate remaining segments as ‘Others’. In the Aggregated Segment name field, enter a display name for the aggregation.

    
    • To start the displayed range from a rank other than 1, enable Start from segment and enter a rank. See Showing Segments from a Chosen Rank.

21. Show only the clicked value in the results - Enable to show only the clicked value in the segmented column of the results table. See Showing Only the Clicked Value in the Results.

22. Click Save.

To segment by a field of a related asset, select the field with Field from in the Segment by section. See Using Fields of Related Assets in Charts.

Showing Segments from a Chosen Rank

Use Start from segment to display segments starting from a rank other than the highest, for example to show OS ranks 11–20 instead of 1–10.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission.

To show segments from a chosen rank:

1. Configure a Field Segmentation chart with a view other than Line.
2. Enable Set maximum segments to display.
3. In Maximum segments to display, enter the number of segments to show (0–50, default 9).
4. In Start from segment, enter the rank of the first segment to show (default 1).
5. Optionally, enable Aggregate remaining segments as 'Others'.
6. Click Save.

• Start from segment defaults to 1. The rank of the last displayed segment must be 1000 or lower.
• Enter whole numbers only.
• The Others segment includes every segment outside the displayed range, both higher and lower ranked. Others has no click-through.
• The CSV export shows only the displayed segments.
• Changing the chart type removes the start rank setting.
• Start from segment is not available in the Line view.

Example: A chart segments devices by OS, with Maximum segments to display set to 10 and Start from segment set to 11. The chart shows the OS types ranked 11–20 plus an Others bar.

Sorting Bars in a Custom Order

Use a custom order to show the bar values in a sequence that fits your data, for example Critical, High, Medium, Low.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission.

To sort bars in a custom order:

1. Configure a Field Segmentation chart with the Bar view, a module, a query, and a Segment by field.
2. In Sorting by, select Custom. The Custom order list appears.
3. Wait for the chart preview to load. The values appear in the list.
4. Drag each value by its handle to the position you want. To use the keyboard, focus the handle and press Alt+Up or Alt+Down.
5. Click Save.

• Custom has no ascending or descending option.
• The list shows up to 20 values from the preview. Others isn't in the list.
• Values that aren't in the list appear after the listed values, with the highest count first.
• Axonius applies the order before it limits the chart to its top segments. The listed values stay in the chart, and the remaining values move to Others.
• When Case-sensitive segmentation is disabled, the order ignores case.
• When you change the Segment by field, Axonius clears the custom order.
• Custom isn't available for the Pie view.

Example: A Bar chart segments devices by vulnerability severity. Select Custom and drag the values to the order Critical, High, Medium, Low. The bars appear in that order and not by count.

Counting Values from Selected Connections

Use Only from connections to count only the field values that come from specific adapter connections, for example to compare two regions that use separate connections of the same adapter.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission. The list shows only the connections that are available in your data scope.

To count values from selected connections:

1. In a Field Segmentation chart, select a module and a query.
2. From Segment by, select an aggregated field or a field of one adapter.
3. From Only from connections, select one or more connections. To search the list, start typing.
4. Click Save.

• By default, the field is empty and the chart counts the values from all connections.
• The list shows only connections that have a Connection Label.
• For a field of one adapter, the list shows only the connections of that adapter. For an aggregated field, the list shows the connections of all adapters.
• The chart counts only the values that come from the selected connections. When you click a segment, the asset page shows the assets whose value came from those connections.
• When you change the Segment by field, Axonius clears the selection.
• Only from connections isn't available for the Aggregated Security Findings and Software modules, for preferred fields, Connection Label fields, or Security Finding fields, or for modules that don't have Exclude adapters.

Example: Two connections of a cloud adapter have the labels "EU Region" and "US Region". Create two Field Segmentation charts that segment by the operating system field. In the first chart, select "EU Region". In the second chart, select "US Region". Each chart shows the values of one region.

Copying the Query Refinement into a Filter

Use Use the query's refinement to count only the values that the saved query's Refine Data conditions keep, so the chart matches the query's table.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission.

To copy the query refinement into a filter:

1. In a Field Segmentation chart, select a module and a saved query that uses Refine Data on a field.
2. In Segment by, select the same field, or a field of the same complex field.
3. Click Add Filter next to the field.
4. Click Use the query's refinement.
5. Review the conditions and change them if needed.
6. Click Done.
7. Click Save.

• The Use the query's refinement option appears only when the saved query refines the segmented field or its complex parent field. Hover over it to see the text "Copy the conditions the chart's query refines this field by".
• The option replaces the conditions that the filter already has.
• When the chart applies the saved query's Refine Data itself, the option doesn't appear. It appears when the system setting Dashboard charts - Apply the saved query's Refine Data is cleared, and for charts that can't apply Refine Data. See Configuring User Interface Settings.
• The option copies the field conditions only. It doesn't copy adapter selections or asset conditions.
• The copy happens one time. When the query refinement changes later, the chart filter doesn't change.
• When you select a different saved query, the option reads the refinement of the new query.
• The option doesn't appear when you open the chart configuration in read-only mode.

Example: The saved query "EOL Software" refines Installed Software to show only software that reached end of life. Create a Field Segmentation chart on this query that segments by the software name. Click Add Filter, click Use the query's refinement, and then click Done. The chart counts only the end-of-life software.

Showing Only the Clicked Value in the Results

Use Show only the clicked value in the results when you segment by a complex field or a field with many values and want the results table to show only the segment you click.

Permissions: To set this option, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission. Every user who can click the chart gets the result.

To show only the clicked value:

1. In a Field Segmentation chart, select a view other than Line.
2. Select a module, a query, and a Segment by field that is a complex field or has many values.
3. Enable Show only the clicked value in the results.
4. Click Save.
5. On the dashboard, click a segment. The results open in a new tab.

• By default, this option is disabled, and the segmented column lists all the values of each asset.
• When this option is enabled, the segmented column lists only the value you clicked. The list of assets doesn't change.
• If the segmented field isn't a column in the results table, Axonius adds it.
• For a field with one value, the results open as before.
• This option isn't available for the Line view.

Example: A Field Segmentation Bar chart segments devices by the Software Name field of Installed Software. Enable Show only the clicked value in the results and click the bar of one software product. The results table lists the devices that have this product. The software name column shows only this product, and not every product of each device.

Timeline Visualization

The timeline visualization shows a trend of the total of the segments and count of all segments as a timeline chart over a set period of time.

1. Select the line presentation.

2. Choose the data series presentation either Total assets and segments or Individual segments (top 20).

   • Total assets shows the total assets.
   • Individual segments show the results by the query with an individual line for each segment. When each segment is displayed, the top 20 assets are displayed. Since the values of the assets vary over time, the assets which are the top 20 on the latest date are displayed.

3. Configure a query as described above.

4. In Aggregate by, select an aggregation time period: Day, Week, Month Quarter, or Year. Query results for weekly, monthly, quarterly, and yearly time periods are aggregated based on the average values for the selected time period. Each data point for weekly aggregation is the average of all daily values since the last weekly period. And each data point for the monthly aggregation is the average of all daily values since the last monthly period. You can choose to exclude date ranges from the displayed range. The legend reflects the time period selected.

   Note

   On the daily aggregation chart, you can click through to the asset list. See Selecting a Table View for more on what data is displayed when you click a chart segment.

   
   

5. In the Show results in the last (days, weeks, months or years) field, specify the number of last days/weeks/months/years or a date range to be included in timeline chart. This date range is displayed on the chart that is created.

6. Select Save.

Duplicate Row

The Duplicate Row button is available on each row in the Field Segmentation chart. When on the first row, it duplicates the entire block and on inner rows it duplicates only the selected row.

If you have created a bar chart, by default, the top 5 results are displayed. Use the pagination button to view the rest of the results.
To export the entire list of results to a CSV file, click the export button.

Examples

OS Types Segmentation

Use the Field Segmentation chart to visualize all OS types currently discovered on all seen devices.

Field Segmentation with Auto-color Assignment

Field Segmentation bar chart with automatic color assignment.

Critical CVEs Segmentation and Trend

Use the Field Segmentation chart to present all critical CVEs currently discovered along all seen devices, and the trend of the total count of critical CVEs over the last month.