InTrust 11.6 - Leveraging Microsoft SQL Server Reporting Services Integration for Advanced Reporting

Report-Driven Data Import

When you work with reports in Knowledge Portal, there is a Specific Actions area in the right pane. Currently, the Data Import option is available in this area for most InTrust reports, but not all of them. Use it to configure import of data required for the selected InTrust report from an InTrust repository to an audit database.

This process is similar to the report-driven data import you set up for your reporting jobs; it uses not only the database connection account, but also an importing account—the one under which data is imported from the source repository to the database.

The authentication method and credentials for the database connection are specified in step 5 of the Report-Driven Data Import Wizard (see the procedure described below). The specifics of using the importing account and database connection account are described in the following table.

To configure data import when generating reports interactively

1. In Knowledge Portal, click the Reports tab.
2. Select the InTrust report you need, and from Specific Actions, select Run Data Import to start the Report-Driven Data Import Wizard. Currently, this specific option is not available for all InTrust reports.
3. On the Specify InTrust Server step, specify the parameters of the InTrust server that will perform data import.
   Here you should supply the following:
   • InTrust server name
   • Connection protocol and connection port to be used

   • Credentials to be used when connecting to InTrust Server

4. Select the InTrust repository to import data from.
   

5. Specify the parameters of InTrust database the data will be imported to:
   The following is required:

   • Server—name of SQL Server hosting the InTrust audit database (this value is supplied automatically in accordance with current configuration)
   • Database—target database name (this value is supplied automatically in accordance with current configuration)
   • Authentication mode—select authentication method to be used for database connection, and supply access credentials. (For details, refer to the table above in this section.)
6. On the next step, set the Computer filter—events from the specified computers will be included in the data import.
7. Set the Date/Time filter to indicate the time period for which you want data.
8. Review the settings you have configured; now you can start data import.
9. Wait for the import process to complete.

On the final screen, review the results of data import; if needed, select View the report after finishing. Click Finish to close the wizard.

Creating Reports

In addition to a number of predefined reports for products supplied in the Report Packs, the Knowledge Portal component provides for creation of custom reports. This process is based on using report models.

A report model helps Report Builder users to explore and select the data that they want to use from the underlying data source. Report models provide familiar business names for database fields and tables, logically grouped model items, and predefined relationships between items within the data source. They are used by the report server to automatically generate a query for retrieving the requested data, thus facilitating ad-hoc reporting.

In Knowledge Portal, predefined models are brought in by the Report Packs you install. Each model defines:

• What product provides data for the reports
• What data source this data should be obtained from

The InTrust model is installed automatically, and you can use this model to create the reports on audit data collected by InTrust. The available models are displayed when you are on the Data Sources tab:

To explore the InTrust model, click the Report Builder tab in Knowledge Portal. Report Builder is launched, and the model tree is displayed on the right pane.

Select the InTrust model from the models tree. From the panes on the left, you can select the objects you are interested in and the fields to obtain the data you need on these objects (such as Trusted Domain). To add an object or a field to your report, simply double-click this item in its pane.

You can use a full range of report building capabilities, as described in detail in Working with Report Builder (Ad Hoc Reports). See also Report Builder Help.

After you get back to Knowledge Portal, the report you create will appear in the reports tree in the left pane. By default, the report will use the data source prescribed by the model it was built on. You can use the Change Data Source option for your custom reports.

Perspectives and Entities

What is a Perspective?

Under the InTrust Model node, the following items are displayed:

• Generic Events
• Windows: Account Management
• Windows: Logons

These items are the perspectives of the InTrust model. A perspective is a subset of a model. For example, the whole InTrust Model allows you to create reports on any kind of events stored in InTrust Audit database, and its Windows: Logons perspective can be used to report on logon events.

After you select a model or any of its perspectives on the right and click OK, a number of entities and their fields are displayed in the left pane, as shown below:

What is an Entity?

In the most common case, an entity corresponds to a database table (or named query). For example, Windows: Failed Logons and Windows: Successful Logons are the entities of the selected Windows: Logons perspective. An entity consists of fields: for instance, the fields of the Failed Logons entity correspond to the event fields as they are presented in Event Viewer (such as Event ID or Date/Time).

Working with Models

To build a report using a model, drag and drop the fields you need, placing them into report layout area on the right.

In addition, you can use the Knowledge Portal to create new models and to change the data source for model-based reports.

To create a model

1. In Knowledge Portal, click the Data Sources tab, select Models node from the tree, and click Create Model from New Model. The New Model Wizard starts.
2. On the Select Model Type step, select the type of model you want to create (generally, the model type corresponds to the product that will provide data for reports built using the model).
3. On the Select Data Source step, select the data source that stores data for reports you will build on this model (each model is assigned one data source).
4. Finally, specify a name and description for the model. Review the settings and finish the wizard. Then the new model appears in the tree.

Each model is intended to work with a particular data source; to change the data source for model-based reports in bulk, you should take the steps described below.

To change the data source for multiple reports

1. Select the corresponding model in the tree.
2. Select Change Data Source from Manage Model.
3. Specify the data source that will provide data for the reports based on this model.

You can also change model and data source for a single model-based report.

To change the data source for a single report

1. Select the report you need from the report tree.
2. Select Change Data Source from Manage Report.
3. Specify the data source you want to use for selected report.

You can create a copy of existing model that you can use to create reports on the same product and the same data source as the original.

To create a copy of a model

1. Select the model you want to copy.
2. Select Clone from Manage Model.
3. Specify the new model's name and description.

Now you can create a custom report using any available model and Microsoft SQL Reporting Services report building capabilities.