Analysis Priorities FAQ

Here are some answers to frequently asked questions about analysis priorities.

What is Advanced Analysis?

Advanced Analysis is an analysis level where records, packets, activity maps, and charts with L2-L7 protocol metrics are available for devices. Prioritize groups or add a device to the watchlist to specify which critical assets should receive Advanced Analysis.

For more information, see Analysis priorities overview.

What is Standard Analysis?

Standard Analysis is an analysis level where records, packets, activity maps, and charts with L2-L3 metrics are available for devices. Prioritize groups to elevate a device or endpoint from Standard Analysis to Advanced Analysis.

For more information, see Analysis priorities overview.

What is Discovery Mode?

Discovery Mode is an analysis level where records, packets, and information about protocol activity are available for devices. Configure analysis priority rules to elevate a device or endpoint from Discovery Mode to Standard or Advanced Analysis.

For more information, see Analysis priorities overview.

What is the watchlist?

The watchlist is a way to prioritize individual devices for Advanced Analysis. In 7.2, the whitelist is renamed to the watchlist. For more information, see Add a device to the watchlist.

What happens to device limits and my current device counts when I upgrade to 7.2?

In 7.2, the device limit is the same as the Advanced Analysis capacity, which is the number of devices that can receive Advanced Analysis. However, additional capacity for Standard Analysis and Discovery Mode is now available, which is known as the total analysis capacity. For more information the capacity associated with different analysis levels, see Analysis levels in the Analysis priorities overview.

When you upgrade to 7.2, the following will happen to your existing device counts:

  • Devices in Full Analysis will receive Advanced Analysis.
  • Devices in Limited Analysis, which means they were discovered after the device limit was reached, receive Standard Analysis and are now available in activity maps. You can also access records, packets, and information about protocol activity for these devices. Prioritize a group for Advanced Analysis or Standard Analysis.
  • Additional devices that were discovered after device limit was far exceeded will be in Discovery Mode, which means that records, packets, and information about protocol activity are available for these devices.
  • Devices on the whitelist are now available on the watchlist. You can view the watchlist from the Analysis Priorities page.

How do I know which devices are in the watchlist?

Log into the Web UI on the Discover appliance, click the System Settings icon and then click Analysis Priorities. At the top of the page, click View the watchlist.

How do I add multiple devices to the watchlist?

Log into the Web UI on the Discover appliance. At the top of the page click Metrics and then click Device in the left pane. Search for devices on the device list page, and then click the checkboxes next to each device that you want to add to the watchlist. Then, click the Add to Watchlist icon in the upper right corner of the page.

For more information, see Add a device to the watchlist.

What analysis level do custom devices receive?

Custom devices can receive any analysis level. You can create a device group with all of your custom devices and prioritize that group for Advanced or Standard Analysis. Or you can add an individual custom device to the watchlist.

Which analysis level supports custom metrics?

Custom metrics are only available in Advanced Analysis. If you want to see custom metrics for a specific device, prioritize a group containing the device or add the device to the watchlist.

How do I determine the analysis level for a device?

Find a device and then click on the device name to open the device overview page. The analysis level is listed at the top of the page, as shown in the following figure.



How do I tell if Advanced Analysis capacity is almost full?

At this time, you can only view the analysis level for individual devices on the device overview page.

Do L2 devices receive Advanced Analysis or Standard Analysis?

Gateways, a type of L2 device, can receive Advanced Analysis or Standard Analysis. L2 devices that are not gateways receive L2 Analysis. Records, packets, and charts with L2-L3 metrics are always available for L2 Analysis devices. L2 Analysis devices do not count towards Advanced Analysis or Standard Analysis capacity, which means that these devices are exempt from the watchlist and prioritized groups.

Published 2018-04-20 23:09