Checking and comparing ratings

Overview

Once you have a set of scores defined, see the actual ratings of devices or users by either:

Opening respectively the device or user view of a particular device or user.
Adding a score column to the displayed results of an investigation on devices or users.

Note however that some scores (or subscores) may be configured to be displayed exclusively in the Portal and not in the Finder. These scores are visible neither from the device view nor from the user view, and they are not eligible for being displayed in the results of an investigation. Some other scores may be configured to be visible in the Finder only in the context of defining a quantity metric.

To learn about the different ways to open the device and user views in the Finder, see the article on observing the activity of users and devices.

To know how to add columns to the list of results of an investigation, see how to edit the options of an investigation or modify its displayed results.

Checking scores in the device and user views

In the device and user view of the Finder, up to 10 score tabs are placed to the right of the Timeline and Properties tabs, depending on the number of scores that you have defined. Each tab displays the name of the score and its current value.

In addition:

If the score defines thresholds, a colored line at the top of the tab indicates the status of the score according to its current value.
If the score defines no thresholds, the scores has no status and it does not show any special color in the tab.
If the Cross-Engine features are enabled in the Finder, a user score is averaged over the individual scores of the user on each Engine where the user was active.

The Finder arranges score tabs by the names of the scores in alphabetical order. If more than 10 scores are available for devices or users, the Finder ignores those in excess. Additionally, the Finder ignores those scores whose current value is null.

Breakdown of a score

Click on a score tab to see the list of leaf scores that make up the main score. If the main score has composite subscores, the leaf scores are organized into groups under the names of the composite subscores to which they belong. The names of the composite subscores act therefore as section headers.

Leaf scores let you reason about the causes for a main score to have a particular value. For instance, in the case of main score having a mediocre value, its decomposition into leaf scores may let you find out whether the final value is caused by a generally medium value of leaf subscores or if there are just a couple of leaf scores with very low values that take the overall value down. For a score that measures Device performance, for example, that would be the difference between having to upgrade the whole device (if all leaf scores perform poorly), or upgrading just the hard disk (if only the leaf scores related to storage are really low).

For each leaf score, the Finder displays:

The value of the leaf score with a background color indicating its status (if any).
The name of the leaf score.
The actual value of the field or computation on which the score is based.

Hover the mouse cursor over the value or the name of the leaf score to get its description in a tooltip.

Status of a score

Scores that define thresholds have a status. The status of a score is indicated by a color which depends on its value. There are three possible statuses:

Green, which means good.
Yellow, which means bad.
Red, which means critical.

The thresholds that determine the ranges of values for each status, as well as their labels, are set in the definition of the score and hence they are configurable.

The status of a score is indicated by the color of the line at the top of its corresponding tab. In its turn, the status of a leaf subscore is indicated by the background color used to display its value. Scores and subscores with no status show no special color.

Viewing score values in investigations

When selecting the display columns of either devices or users, find the Scores section at the bottom of the selection dialog. For each defined score, select either the main score or any subscore that you wish to see in the list of results of the investigation.

Whereas the device and user views let you see all the scores of a particular device or user, investigations let you compare the value of a particular score among many devices or users at the same time.

When examining the scores of users on the List (all entities) view (i.e. in a Cross-Engine context), the score of a user is averaged over the individual scores of the user on each Engine where the user was active. Note that a same device that is active on several Engines is considered a different device by each Engine. Thus, on the List (all entities) view, a single device has a different entry per Engine and displays the local score on each entry.

Scores with a null value are represented with a dash sign (-) in the lists of results of an investigation.

RELATED TASKS