RSA® Archer Administration

Video-ILT Course

Searching and Reporting

Module Guide

RSA Educational Services

ED ARCADM DVD
Rev. A1
 Using this Guide

This guide is designed to be used in conjuction with an RSA Educational Services Video-ILT course. The course
contents describes the subject matter contained in this guide.

This guide is provided to give the sutdent the ability to obtain a hard-copy of the presentation slides as well as
explantory text of the course material. The content of this guide is an excerpt of the material contained in an RSA
instructor-led classroom course.

Copyright © 2011 by RSA, the Security Division of EMC. All rights reserved.

ii RSA® Archer Administration Student Guide

 Search and Report on Data

Objectives After completing this module you should be able to:

• Execute an advanced search

• Create a chart

• Save your search results as a report

1
Search and Report on Data

2 RSA Archer Administration

 Search and Report on Data

Searching and Reporting

Overview Searching gives you the ability to locate specific records within content
applications and to display values from multiple records on your screen.
After running a search, you can save the search criteria as a named
report, enabling you to easily access your search results at any time.
The system provides two methods for searching:

• Quick Search (from the top frame)

• Advanced Search (from the Navigation Menu)

Once you’ve defined the criteria for your search, you can then select from
a variety of search display formats. Search displays allow you to modify
how your results will be presented to your end users so you can
communicate Archer information in a variety of formats.

3
Search and Report on Data

4 RSA Archer Administration

 Search and Report on Data

Quick Search

Quick Search The Quick Search feature in the top frame of the application allows you to
perform a keyword search in multiple applications within a single solution.
Overview The solutions dropdown in quick search is automatically changed to
match the selected Workspace. It will default to the first solution in the
current Workspace.

Keyword Search You can combine multiple query types to produce complex keyword
searches. For example:
Operators
• “important document”
This keyword search will return all records that contain the phrase
“important document.” It is essential that you enclose your phrase in
quotation marks. If you do not, your search will return all records that
contain the term “important” OR the term “document.”

• receive~
This keyword search will return all records that contain the term
“receive” and any other term that is similar in spelling. Fuzzy
searching enables you to search for keywords that may be misspelled
within records, so if you search for “receive~”, your search will also
return records that contain “recieve,” "reseive," etc. Please note that
the tilde symbol (~) must appear directly after the term with no space
between the term and the symbol.

• NOT
This keyword search will return all records that contain the term
“important” but do not contain the term “document.” Please note that
you must capitalize the NOT operator. You can also use an
exclamation point (!) in place of the NOT operator (e.g., important!
document).
For a complete listing of keyword operators, see the RSA Archer Help
system in the top frame of the system.

Searching When executing a Quick Search, you can search for records that contain
specific terms or phrases and you can also keyword search into files that
Attachments are attached to records through an Attachment field. Remember, the
option to allow attachment searching is a field configuration set by the
administrator for each field. The following is a list of file types that you
can keyword search:

• Microsoft Word

• Microsoft Excel

• HTML

• PDF

• Text

5
Search and Report on Data

6 RSA Archer Administration

 Search and Report on Data

Advanced Search

Advanced Search The Advanced Search page enables you to keyword search for specific
records or files in an application, to format the display of your search
Overview results and to define filter criteria to narrow the results of your searches.
The page also provides controls for creating statistical reports by grouping
and aggregating field values. In addition, if the application you are
searching in is related to other applications, the Advanced Search page
enables you to include fields from those related applications in your
search.
From the Advanced Search page you have the ability to set the following
parameters for your search:

• Keyword Search

• Fields to Display

• Filters

• Sorting

• Display Options

Keyword Search From the Advanced Search page, you can search for records that contain
specific terms or phrases. You can also keyword search into files that are
attached to records through an Attachment field, and you can keyword
search the names of files associated to a record within an Attachment or
Image field.

Fields to Display From the Advanced Search page, you can select the fields of data that
should display in your search results.
If the application you are searching in is related to other applications
through a Cross-Reference or Cross-Application Status Tracking field,
you can select fields from the related applications to display in your
search results by using the “Add New Relationship” link. Once you have
selected your fields to display, you can also arrange those fields so they
display in the appropriate order.

7
Search and Report on Data

8 RSA Archer Administration

 Search and Report on Data

Advanced Search, continued

Filters From the Advanced Search page, you can establish field-value criteria for
filtering records. Records that contain the field values you select will be
included in the search results, and records that do not will be omitted. For
example, if you were searching for records in the Devices application, you
could use field-value filter criteria to return only those records where the
value “Accounting” is selected in the Business Unit field and where the
value “Desktop” is selected in the Type field.
The Filters feature also enables you to exclude records from your search
results if they contain certain values. For example, you could execute a
search in the Devices application that will bring back all device records,
excluding those where the value “Laptop” has been selected for the Type
field.
When building a filter, you evaluate data from any of the following fields
types:

System Fields Basic Fields Advanced Fields

• First Published • Date • Cross-

Date Reference
• IP Address
• Last Updated • Matrix
Date • Numeric
• Record
• Record Status • Text Permissions

• Voting • User/Groups List • Child fields

within Sub-Form
• Values List

When you select to filter on one of these fields, you can also select one of
the following search operators to determine how Archer will apply the
filter:

Available Operators

• Equals • Change From • After Today

• Does Not Equal • Greater Than • Prior to Today

• Contains • Less Than • Current

• Does Not • Between

Contain
• Last
• Changed
• Next
• Changed To

9
Search and Report on Data

10 RSA Archer Administration

 Search and Report on Data

Advanced Search, continued

Current User Filter If you are creating a report in an application with a Users/Groups List or
Record Permissions field, you can filter your search results so they
display only records relevant to the user who is viewing them.
The “Current User” filter allows you to create a report that dynamically
adjusts content based on the user executing the report. For example, you
could create a “My Incidents” report for your Investigators team.

• When Incident Investigator A executes the report, only the incidents

assigned to him would be displayed.

• When Incident Investigator B executes the report, only the incidents

assigned to her would be displayed.
Utilizing this feature, you can create an iView that will display information
dynamically, dependent upon the current user.

Sorting In the Sorting section on the Advanced Search page, you can configure
how your search results will be sequenced. For example, if you select to
sort information by the values in the “Name” field, records included in your
search will be sorted, alphabetically, by the value in each record’s “Name”
field.
The sorting interface supports sorting on multiple fields. Adding additional
fields for sorting is useful when your search results yield a “one-to-many”
relationship between the initial sorting field and the additional sorting
fields. For example, if you select to sort records in the Vendor Profile
application records by the values in the Risk Rating field multiple records
may have the same value. By including an additional sorting field, you can
sort how records appear within the initial sort.

Display Options Seven display options are available for standard searches:

• Column - Hierarchical

• Column - Flat

• Row

• Summary

• Card

• Calendar

• Map
In addition, you may adjust the number of results returned per page and/
or opt to only display a finite total of records (i.e. display only 10 of the
possible 5,000 records.)

11
Search and Report on Data

12 RSA Archer Administration

 Search and Report on Data

Advanced Search, continued

Display Results - The Column format shows your search results in a columnar layout where
fields are displayed across the page from left to right. Select this format if
Columnar Options
you plan to export your search results into Excel or .csv format. This
format has two options:

• Column-Flat

• Column-Hierarchical
The Flat format displays field values in a simple column layout. The
Hierarchical option provides the option of grouping the results by the
values within the search results fields, as shown below. If you select the
Column-Hierarchical option, you can enable the grouping option in the
Sorting section of the Advanced Search page.

Display Results - The Row format displays your search results in a row layout where fields
are stacked vertically and records are separated by horizontal lines. This
Row
format does not display field labels for empty fields.

Display Results - The Summary format displays your search results in a simple “block”
record format in which all field names are omitted. The key field serves as
Summary
a heading for each record block while the additional fields specified in the
search are displayed in a single paragraph with each field value
separated by a diamond symbol.

13
Search and Report on Data

14 RSA Archer Administration

 Search and Report on Data

Advanced Search, continued

Display Results - The Card View format shows your search results in a series of rectangular
boxes, with a maximum of four records displayed across the page. The
Card
page expands vertically to accommodate more records. This view
displays fields from the primary application in flat searches or fields from
the first level of the primary application in leveled searches. Print and
export results for this format appear the same as they do for the Column
options.

Display Results - The Calendar format renders search results in a calendar display. Using
this format, you can quickly gain insight into the due dates of upcoming
Calendar tasks, pending assessment dates and more. This format is available for
applications with at least one date-type field: Date, First Published and
Last Updated. When reviewing the search results, you can toggle
between day, week, and month views. Also you can create events in one-
hour blocks or all-day events. Each calendar entry automatically includes
a Microsoft Outlook iCalendar icon, which allows users to easily add
important events to their own calendars in Outlook.

Display Results - Map The Map format option enables you to dynamically render location
information related to content records as a plot on a visual map. When
displaying your search results in Map format, you can display the map in
road or aerial view. You can also assign varying pin colors to plotted
locations to allow visual differentiation of the data represented within the
map. Additionally, you can save your map as a named report.
When building a Map format search, you specify the field(s) in your
application that contains the address information, which are used to plot
your search results on the map. Address information can be stored in a
single Text field or combination of multiple fields. If you select multiple
fields, the fields must be positioned in the correct order. Successful
generation of the map display depends on the designated field(s)
containing sufficient address data.

Note: A Microsoft mapping license must be obtained and entered into the
Archer Control Panel in order to enable the mapping search results
feature. This is typically done during intial installation, but may be added
by the system administrator at a later time.

15
Search and Report on Data

16 RSA Archer Administration

 Search and Report on Data

Advanced Search, continued

Search Results After you run your search, you will see a toolbar across the top of your
results. From this toolbar, you can select from the following options:
Toolbar
• The “New” icon allows you to add a new record to the primary
application from your results.

• The “Modify” icon allows you to redefine your search criteria and run
the search again.

• The “Save” icon allows you to save your search criteria as a report
that can be executed as often as you wish.

• The “Reports” icon allows to quickly execute reports previously saved

from the primary application of your search.

• The “Navigation” icons allow you to jump through pages of search

results, go directly to a specific page or navigate to the first or last
page of search results.

• The “Export” icon allows you to export the records from your search
into a variety of available formats.

• The “Print” icon allows you to print your search results.

• The “Email” icon will send a link to search results, not the results
themselves. Therefore, the recipient of that email must have
appropriate access rights established to access the link.

17
Search and Report on Data

18 RSA Archer Administration

 Search and Report on Data

Advanced Search, continued

Exporting Data To export all of the records contained in an application, you will need to
return the records and field values in a search and then export the results.
Complete the following steps to export the contents of your search
results:

1. Perform an Advanced Search

2. Include all fields in the Fields to Display section

3. Do not add any Filters

4. Click Search

5. Export the results into the format of your choice. If you plan on taking
these results and importing them into a separate application, Archer
recommends exporting your results as a CSV file.

Note: Search results only display the records the user running the search
has access to. If you need to export all of the records, these steps must
be completed by a user with access to all of the records.

19
Search and Report on Data

20 RSA Archer Administration

 Search and Report on Data

Statistics Search

Statistic Search The Advanced Search page provides controls for creating statistical
reports by grouping and aggregating field values. In addition, if the
Overview application you are searching in is related to other applications, you can
include fields from those applications in your search. To run a statistics
search, complete the following steps:

1. Select the Statistics Mode checkbox, which is located under the

Available list in the Fields to Display section. Selecting this option will
clear any selected display fields, enabling you to create your
statistical report from scratch.

2. Add the field(s) on which you want to apply grouping or aggregate

functions.

3. Select the grouping or aggregate function you want to apply.

Grouping and aggregate functions include the following options:

— Group by / Group by (day, week, month, quarter)

— Count Of
— Average Of (numeric and voting fields only)
— Sum Of (numeric and voting fields only)
— Minimum (date, numeric and voting fields only)
— Maximum (date, numeric and voting fields only)

4. Run your search.

Display Your Search When you execute a statistics search, the results of your search will
display as statistical data in a table. You can then select to display this
as a Chart search as a chart, which provides you with a more concise, visual
presentation of the information.
The default chart type is a 2D vertical bar chart. To enable the charting
feature, the “Group by” function must be the first function listed in the
Selected pane within the Fields to Display section on the Advanced
Search page. If an aggregate function is listed first, the Charting toolbar
will not display.

21
Search and Report on Data

22 RSA Archer Administration

 Search and Report on Data

Statistics Search, continued

Chart Types - Vertical Vertical and horizontal bar charts are used to render single-series and
multi-series charts.
and Horizontal Bar
• Single-Series Chart: In the single-series chart type, a single data
point is plotted for each element in the specified data category. If a
statistics search contains only one “Group by” function and one
aggregate function, the application renders a single-series chart.

• Multi-Series Chart: In the multi-series chart type, multiple data

points are plotted for each element in a data category. If a statistics
search contains two “Group by” functions, the application renders a
multi-series chart.
Vertical and Horizontal bar charts can be displayed in the following
formats:

• Standard: In the standard chart display variation, each data point is

represented as an individual bar.

• Stacked: In the stacked chart display variation, the data points are
stacked upon each other in a single bar, which is oriented vertically or
horizontally according to the selected chart type. The bar is divided
based on the number of records included in each data grouping.

• Full Stacked: In the full-stacked chart display variation, the data

points are stacked upon each other in a single bar, which is oriented
vertically or horizontally according to the selected chart type. The bar
represents a value of 100 percent, and each data point within that bar
represents a portion of the total percentage.

• Cylinder: In a cylinder display variation, each data point is

represented as an individual vertical or horizontal cylinder.

• Stacked Cylinder: In the stacked cylinder display variation, the data

points are stacked upon each other in a single cylinder, which is
oriented vertically or horizontally according to the selected chart type.
The bar is divided based on the number of records included in each
data grouping.

• Full Stacked Cylinder: In the full stacked cylinder chart display

variation, the data points are stacked upon each other in a single
cylinder, which is oriented vertically or horizontally according to the
selected chart type. The cylinder represents a value of 100 percent,
and each data point in that cylinder represents a portion of the total
percentage.

• Pareto: In a pareto chart, each data point is represented as an

individual vertical bar. Additionally, a second line-type data series is
calculated from the original data series with the data points displaying
as symbols, such as discs or diamonds, connected by lines.

23
Search and Report on Data

24 RSA Archer Administration

 Search and Report on Data

Statistics Search, continued

Chart Types - Pie and Pie charts render single-series charts. The data points for each series are
plotted as slices (wedges) in a 2-dimensional or 3-dimensional pie. Pie
Donut
charts do not support multi-series charting.
Donut charts render single-series charts. The data points for each series
are plotted as slices (wedges) in a 2-dimensional or 3-dimensional donut.
Donut charts do not support multi-series charting.
Pie and donut charts can be displayed in the following formats:

• Standard: In the standard display variation, all slices of the pie chart
are connected.

• Exploded: Largest Slice: The exploded: largest slice display

variation shows the largest slice of the pie or donut chart as
separated from the rest.

• Exploded: Smallest Slice: The exploded: smallest slice display

variation shows the smallest slice of the pie or donut chart as
separated from the rest.

• Exploded: All Slices: The exploded: all slices display variation

shows all slices of the pie or donut chart as separated.

Chart Types - Gauge Gauge charts plot a single data point within a circular gauge (dial) device.
The scale values are distributed in a clock-wise fashion on the face of the
gauge. A colored needle originates from the center of the gauge and acts
as the data point. A single gauge can display only a single data point. If a
statistics search results in a series consisting of two or more data points,
a gauge will be displayed for each of the data points. No more than 32
gauge charts can be rendered in one set of search results. Gauge charts
do not support multi-series charting.
Gauge charts can be displayed in the following formats

• Standard: In the standard (gauge) display variation, the gauge chart

is displayed in a circular format.

• Clipped: In the clipped display variation, the circular gauge has a

flattened bottom.

• Indicator Lights: In the indicator lights display variation, values are

displayed as separate circles with numeric values. This display
variation is available for the gauge chart type.

25
Search and Report on Data

26 RSA Archer Administration

 Search and Report on Data

Statistics Search, continued

Chart Types - Funnel Funnel charts are used to render single-series charts. The funnel
represents a value of 100 percent, with each data point in the stack
representing a portion of the total percentage. Options for displaying this
chart include 2-dimensional (flat) or 3-dimensional standard or squared
format.
Funnel charts can be displayed in the following formats:

• Standard: In the standard display variation, the funnel chart is

displayed in a rounded format

• Squared: In the squared display variation, the funnel chart is

displayed in a squared format.

Chart Types - Line Line charts are used to display data trends and compare data sets. The
data points are plotted as symbols, such as discs or diamonds, connected
by lines. For example, you can create a line chart to show overall average
customer satisfaction ratings over the past 12 months, or you can create
a line chart to compare average customer satisfaction ratings for each
customer service representative over the past 12 months. You can display
a line chart when using two "Group by" functions in combination with an
aggregate function, such as "Average of". You can display the line chart in
2-dimensional (flat) or 3-dimensional stacked, rounded, or rounded-
stacked format.
Line charts can be displayed in the following formats:

• Standard: In the standard display variation, the data points are

displayed as symbols, such as discs or diamonds, connected by
lines. If the chart is in 3D format, the symbols are connected by
ribbons.

• Stacked Line: In the stacked display variation, the data points are
stacked upon each other with the area below the lines shaded. To use
this option, you must be dealing with a multi-series chart.

• Rounded: In the rounded display variation, the data points are

displayed as symbols, such as discs or diamonds, connected by
curved lines. If the chart is in 3D format, the symbols are connected
by curved ribbons. This display variation is available for the radar
chart type.

• Rounded Stacked: In the rounded stacked display variation, the data

points are stacked upon each other with the area below the curved
lines shaded. To use this option, you must be dealing with a multi-
series chart. This display variation is available for radar chart type.

27
Search and Report on Data

28 RSA Archer Administration

 Search and Report on Data

Statistics Search, continued

Chart Types - Bubble Bubble charts are used to display data as bubbles, which is useful for
visualizing multiple data dimensions.
Bubble charts can be displayed in the following formats:

• Standard: In the standard display variation, the X axis represents the

first group-by, and the Y axis represents the second group-by. Only
two group-by's are supported. The data values are represented by the
bubble size. This display variation is available for the bubble chart
type.

• Stacked Bubble: In the stacked bubble display variation, the data

points are represented as individual bubbles stacked within each
other. Each bubble size is based on the data values.

• Off-Center Stacked: In the off-center stacked display variation, the

data points are represented as individual bubbles stacked within each
other, but set off center. Each bubble size is based on the data
values.

Chart Types - Radar Radar charts are used to display data points relative to a center point,
which is useful for comparing the aggregate values of several data series.
Radar charts can be displayed in the following formats:

• Standard: In the standard display variation, the data points are

displayed across multiple axes. For example, in a multi-series chart,
the number of axes is determined by the number of values in the field
listed as the second "Group by" in your search criteria. If this field has
four values, the system renders the data across four axes.

• Multiple Radars: In the multiple radars display variation, the data

points are displayed on separate radar charts. For example, in a
multi-series chart, the system renders a separate radar chart for each
value in the field listed as the first "Group by" in your search criteria. If
this field has two values, the system renders two radar charts.

29
Search and Report on Data

30 RSA Archer Administration

 Search and Report on Data

Statistics Search, continued

Charting Toolbar The 3D checkbox allows you to toggle between 2D and 3D rendering of a
chart. When the 3D checkbox is selected, the chart is redrawn in a three-
dimensional format. If the checkbox is then cleared, the chart reverts to a
two-dimensional format.
The Chart Options dropdown menu lists the display variations available
for the selected chart type. Any time you change the chart type, the Chart
Options dropdown menu is dynamically updated to display the valid
options for the selected chart type. When you change the chart type, the
application automatically selects the No Variation option for the new chart.
Clicking the Chart Colors icon opens the Chart Colors dialog, which
enables you to specify the color properties for the data series, the legend
and the plot area. In the Data Series control group, you can select from
predefined color pallets or you can select a specific color for each data
series. In the Legend and Plot Area control groups, you can select from
groupings of basic or custom colors.
The Transparency Level dropdown menu enables you to display the
chart's data series as opaque (solid) or transparent to some degree.
Available transparency levels include 25%, 50% and 75%. By default,
data series are displayed as Opaque. The gauge chart type does not
support transparency; gauges are always opaque. If the current chart is a
gauge type, the Transparency Level dropdown menu is disabled.
The FX menu lists the shading (light casting) effects that you can apply to
data series based on the currently selected chart type and whether the
chart is set to display in a 2D or 3D format. This dropdown menu is not
available for the gauge chart type or for 3D pie and donut charts. You also
have the option of specifying a threshold marker for your chart. A
threshold marker is a static line, needle, or shaded area that can be
added to charts to communicate a goal, requirement level, overload
range, comparison figure, and so on. You can set markers on vertical and
horizontal bar charts in solid, dotted, or dashed line format. For gauge
charts, you can set markers in needle or range format.
The 321 (Value Labels) dropdown menu provides options for displaying
numeric value labels relative to series data points (e.g., bars or pie slices)
within a chart. The available options vary depending on the selected chart
type. The options available for pie and donut charts include Automatic,
Inside Series, Outside Series and No Value Labels. The options available
for bar or gauge charts are limited to Automatic and No Value Labels. This
dropdown menu also provides options for positioning the legend relative
to the plot area of the chart: Top Right, Middle Right, Bottom Right, Below
Chart and No Legend. The No Legend option allows you to suppress the
display of the legend. By default, the legend position is set to Top Right.

31
Search and Report on Data

32 RSA Archer Administration

 Search and Report on Data

Reporting

Reporting Basics After executing an advanced search, you have the option to save your
search criteria as an RSA Archer report. From the Save Report page, you
can save the results of a search operation as a named report that you can
re-execute in the future. It is important to note that saving search results
as a named report saves the search criteria, not the specific records in
your search results. Therefore, each time you open a report, all records
that meet the report's search criteria will display, regardless of whether
those records were included in the original search results.
Depending on the rights granted to you by the administrator of the
application you are searching in, you can choose to save a report as
either personal or global. A personal report is available only for your use,
while a global report can be made available to other users or groups.

Personal vs. Global A personal report is a report that is available only to the user who
created it. Personal reports can never be shared with other users. If a
Reports
user has sufficient access, that user can promote the personal report to a
global report.
A global report can be shared with other end users. When creating a
global report, a user can share the report with just one other user, with
several other users, or with all users. Only users with specific access
rights - system administrators, applicaiton owners and global report
administrators - can create global reports.

33
Search and Report on Data

34 RSA Archer Administration

 Search and Report on Data

Reporting, continued

Report Templates You can define templates for search results that are exported to external
data files. The Manage Global Print and Export Settings page enables
you to upload Microsoft Word templates, which are used for data exports
in Word or PDF format, and Microsoft Excel templates, which are used for
Excel exports.
Administrators can also upload templates to support Mail Merge
functionality. This option allows users to export record content into pre-
formatted Word documents.

Display Reports In addition to viewing reports displayed on a dashboard, users can

access the reports they have access to through the following options:

• Reports link at the top of the system

• Reports link in the Navigation Menu of a workspace

• Reports icon in the Search Results toolbar

35
Search and Report on Data

36 RSA Archer Administration