Group By: Frequently Asked Questions (FAQ)

Summary: A collection of frequently asked questions (FAQ) and their answers regarding the Group By feature in Ivanti Neurons.

Answer: Group By allows our users to view aggregate counts of assets and findings based on certain filter types. Using this feature, you can answer questions such as:

Answer: The Group By feature is available on the following pages:

The table below shows whether each page supports a Group By based on a platform field. For scanner-specific fields, visit the article Scanner-Specific Fields as Group By.

Excluded scanner-specific fields usually contain long text like JSON objects or lists of values. If you performed a Group By on the field, you could only perform the operation over distinct strings. For example, say that you tried to do a Group By on a field called Operating System History. If you found a list like “Ubuntu 18.04 LTS, Windows 10 Professional Edition, Ubuntu 20.04 LTS”, the count of hosts would only include hosts with that exact history.

Answer: All Group By return up to 100 rows per page by default. You can change the number of rows per page within the page configuration settings temporarily.

At maximum, you can see up to the first 1000 results within the platform.

Answer: To sort the Group By view by a specific column, click on the column header. You will sort the Group By view in descending order for that column. If you click the column again, you will sort the Group By view in ascending order.

Note that you are running a new Group By operation when you change the sort. The system may take a few moments to run the new query and display the results.

Answer: You can apply filters the same way that you apply filters to the normal view of your assets or findings. You can apply filters either before adding a Group By or after applying a Group By. If you apply filters after you apply a Group By, keep in mind that the filters operate on the underlying data (assets or findings) rather than directly on rows shown in the Group By view.

Answer: If a column has sort disabled, you will not see an arrow appear next to the column name if you hover your mouse over the column header. If the total size of your dataset exceeds 100,000 rows, you can only sort the Group By view by the Group By column You will see a warning pop up if you try to sort the Group By view by any other column. To re-enable sorting, try using filters to reduce the total size of the dataset.

Answer: By default, all Group By views are sorted by the Group By column. The table below shows the default sorting behavior for each Group By. If the Group By field is sorted alphanumerically, terms starting with lower-case letters come after terms starting with upper-case letters.

Answer: Currently, you can only Group By one field at a time.

Answer: Currently, the platform applies the default settings for a Group By view each time that you use the Group By drop down to select a new Group By operation.

Answer: If you click on a link in the Hosts or Fixes columns, you will go to another page in the platform with different filters. Group By creates links based on ID filters when you go from a Group By view to another page in the platform. A single link can contain up to 5,000 IDs. The same limitation applies to links from the Application Findings Group By views to the Applications page.

Answer: All Host Findings and Application Findings Group By let the user add the columns VRR Critical, VRR High, VRR Medium, VRR Low, and VRR Info. These columns show the total counts of findings by default. To view just Open findings, apply Status is exactly Open as a filter.

Answer: Add the Severity Group columns (Severity Critical, Severity High, Severity Medium, Severity Low, and Severity Info) to the Group By view through the Settings menu.

Group By can display up to 1,000 items. To view all items, export the results of your Group By to a CSV, JSON, or XLSX file.

Answer: The Group By query for the export will include your active filters. Your current sort will have no impact on the order of items in the export file.

Answer: Group By returns estimates for counts. The platform abbreviates numbers by truncating them and appending “K” (thousands) or “M” (millions). Exports show the original estimates. Use the spreadsheet program of your choice to sort data and format numerical columns.

Answer: This may occur if the Group By returns 2 (or more) values with the same letters and different capitalization schemes. Group By treats values with different capitalization schemes as separate values. On the other hand, list view filters return all results for any match regardless of case. This behavior impacts features that either implicitly or explicitly rely on Group By, including user widgets based on Group By views.

The following example demonstrates this. Assume that you have applied a tag called “testTag” to 5 open findings and another tag called “TESTtag” to 4 open findings. In the Group By, you will see both of these tags when you group your findings by tag name.

If you click on the Open Findings column in either row, the filter query will return 9 results.

Answer: You may encounter this scenario if you try to perform a Group By on fields such as Tag, Group name, CVE, CWE. Findings and assets can be associated with one or more group, tag, CVE, or software weakness. Similarly, a single group, tag, CWE, or software weakness can be associated with more than one finding or asset. Consequently, fields such as Tag and Group Name have a “many-to-many” relationship with assets and findings.

These data relationships have an impact on filtering. When you do Group By, your filters are applied to the dataset before the Group By operation occurs. Depending on the filters that you have selected, you may see more items or fewer items than you expect.

The following examples demonstrate how the underlying data relationships can impact filtering.

Multiple hosts are in the group “Canada”. You want to do a Group By to find out many hosts within the group are potentially vulnerable to ransomware.

To build this query, first add a filter for the group “Canada” and a filter for findings with ransomware threat. Second, do a Group By on Status.

The Status Group By shows you how many hosts within the group have open or closed findings associated with ransomware threat.

Now, change the Group By to Group Name. This Group By will show you all the groups that share hosts with the group “Canada”.

Assume that your client has 2531 CVEs present on open findings. If you do a Group By on CVE, you will see the actual total number of CVEs in the upper right.

While exploring the data, you try to remove the CVE-2014-3566.

Since the filters operate on the underlying findings, your query removes any finding with CVE-2014-3566. The remaining number of CVEs in the dataset is 2494.

Answer: The system only allows a certain number of concurrent Group By operations to run at once. This limit is applied per platform (as opposed to per user or per client).

Answer: This section describes possible uses of Group By.

Apply the CVE Group By on the Host Findings page. To narrow the list to just unremediated CVEs, filter on Status is exactly Open. Then click the Hosts column to sort the view by host count.

The Scanner Plugin Group By lacks a sort directly on the VRR for the scanner plugin. One work around is to sort the list by the count of findings in a particular VRR Group. For example, sort the list by the column VRR Critical, the total count of Critical findings, to identify the scanner plugins with a VRR between 9.0 and 10.0.

Apply the Operating System Group By on the Host Findings page. Then click the Fixes column to sort view by highest fix count (patch count).

On the Hosts page, apply IP Address Type is exactly Internal as a filter. Then apply the RS³ Group By. The Group By view will be sorted from lowest RS³ range to highest RS³ range by default.