Query Intersection Chart

The Query Intersection chart is a multiple queries metric, consisting of a base query and multiple intersecting queries. You can use this chart to display the number of assets represented by the intersecting queries compared to the base query and highlight the overlap between the intersecting queries.

The following visualizations are supported:

• Pie
• Bar
• Venn
• Venn Triangle (Axonius Identities users only)

To configure a Query Intersection chart:

1. In Chart title, type a name for the chart.

2. (Optional) Add an optional description if you want.

3. From the Widget dropdown, select Query Intersection.

4. Under Visualization, select a one of the options:

   • Pie - Shows the result of up to 2 metrics as a percentage of the total base query entities.
   • Bar - Shows the same results as the Pie view as horizontal bars, with optional threshold colors.
   • Venn - Shows results as overlapping circles, highlighting overlaps and exclusivity.
   • Venn Triangle - (Axonius Identities users only) Shows results of up to 6 metrics as overlapping triangles.

5. From the Module dropdown, select an asset module.

6. From the Base query dropdown, select or create a base query or leave empty for all entities. Learn more about creating a query.

7. Select or create new intersecting queries.

   • Pie - Select up to 2 intersecting queries.

   • Bar - Select up to 2 intersecting queries.

   • Venn - Select up to 3 intersecting queries.

   • Venn Triangle - Select up to 6 intersecting queries.

     As you configure the chart, a preview is created in the left pane. A legend is created with one entry for each section of the graph, including the overlap sections. When you hover over the legend, the areas of the graph are highlighted, and a pop-up displays the details of the highlighted section.

     You can assign chart colors to asset count thresholds to easily evaluate the current environment. See Setting Threshold Colors.

8. (Optional) To calculate by asset entity instead of aggregated asset fields, select the Calculate by asset entity toggle. You can also select an adapter to calculate by assets fetched from that specific adapter.

7. Click Save. A chart is generated and displayed on the dashboard.

Pie Chart

For example, creating a Query Intersection chart with a base query of all devices, and devices seen in the last 7 days, and with devices seen in the last 30 days as 2 intersecting queries will result in (last 30 days contains all last 7 days devices):

Click the link on each of the slices of the pie chart to see the Devices page displaying the corresponding list of devices.

Bar Chart

Use the Bar view to show the base query and the intersecting queries as horizontal bars, and to color the bars by threshold.

Permissions: To add a chart, you need the Dashboards > Charts > Add permission. To edit a chart, you need the Dashboards > Charts > Edit permission.

To configure a Bar chart:

1. On a dashboard, click Add Chart and select Query Intersection.
2. Select the Bar view.
3. In Query (or empty for all), select the base query.
4. In New Query 1 (or empty for all) and New Query 2 (or empty for all), select one or two intersecting queries.
5. (Optional) In Presentation, in Value type, select Quantity or Percentage.
6. (Optional) Enable Set threshold colors, and set the ranges (From and To) and a color for each range.
7. (Optional) With one intersecting query, enable Apply thresholds to the intersection only.
8. Click Save.

• The Bar view shows the same segments as the Pie view: the base query only, each intersecting query, and the intersection of the two intersecting queries.
• The Bar view takes at most 2 intersecting queries, the same as the Pie and Donut views.
• Quantity is the default value type. It shows the count of each bar. Percentage shows the part of the base query. The threshold ranges use the same type. When you change Value type, the ranges go back to their defaults.
• Without thresholds, each bar has the color of its pie slice. The bar of the intersection mixes the colors of the two queries.
• When you enable Set threshold colors, each bar takes the color of the range that contains its value. You can add up to 10 ranges. The color pickers of the intersecting queries are hidden.
• Set threshold colors is disabled when the chart has two intersecting queries.
• Apply thresholds to the intersection only appears only with one intersecting query and thresholds enabled. The intersection bar takes the threshold color, and the base query bar keeps the base color.
• Show values shows or hides the value on each bar.
• To set the value that fills the full width of a bar, see Setting the Bar Axis Maximum.
• When you click a bar, the asset page opens with the query of that bar. The table shows the columns of the queries behind the bar, the same as when you click a pie slice. Vulnerabilities and Asset Investigation charts show a message instead of opening a page, the same as the Pie view.

Example: The base query is "All devices", the intersecting query is "Missing EDR", the view is Bar, and Value type is Percentage. Set the thresholds 0 to 15 in green and 16 and more in red, and enable Apply thresholds to the intersection only. The "Missing EDR" bar is green or red, and the "All devices" bar keeps its base color.

Venn Chart (Circle)

Venn charts offer a simple and intuitive option for the majority of use cases, where you simply need to quickly compare several categories.

Venn charts have the following benefits:

• You can easily see overlaps and exclusivity between 2-3 categories or queries directly in dashboards.
• Analysis of intersections is faster, clearer, and less error-prone, reducing the need for exports and lowering demand on support teams.
• Dashboards are more effective for communication, since circles are intuitive and easy to present to non-technical stakeholders.

Changing the Name of a Venn Circle Chart Section

By default, sections of a Venn circle chart are named after the query they represent. You can change the name of chart sections to something more meaningful.

To change the name of a chart section:

1. Configure the chart how you want it. A preview of the chart is displayed in the preview pane with a legend whose items are labeled after the names of the queries that the sections represent.

2. In the preview pane, click (Edit) next to the legend item whose name you want to change.

   

3. In the edit window, enter the name you want.

   

4. Click (Save) to save the changes. Click the (Reset) to go back to the original name.

   

Venn Triangle Chart

This chart visualization is available to Axonius Identities users only.

Hovering over any section of the chart displays a pop-up describing that section.

Showing Asset Investigation Events

Use a Query Intersection chart to compare the field change events of saved Asset Investigation queries.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission. You also need the Asset Investigation > View permission. A user inside a data scope sees an empty chart.

To compare Asset Investigation events:

1. On the Asset Investigation page of an asset type, save the queries you want. See Asset Investigation.
2. On a dashboard, click Add Chart and select Query Intersection.
3. For the base query and each intersecting query, select the module Asset Investigation - and a saved query of that module.
4. Select a view.
5. Click Save.

• The base query and the intersecting queries come from the same module.
• The Pie, Donut, Bar, and Venn Triangle views show the events of each exact combination, and the other events of the base query. The Venn view shows the events that are in all the queries of a region.
• The option to calculate by the asset entity, the historical date, and the net change aren't available.
• When you click a segment in the Pie, Donut, or Bar view, the message "Click-through isn't supported for intersections of Asset Investigation events." appears. You can't click the regions of the Venn views.

Example: Save the Asset Investigation queries "All changes" and "OS changes" on Devices. Create a Query Intersection chart with "All changes" as the base query and "OS changes" as the intersecting query to see how many events are OS changes.