Using Halo Reports
The reporting service of the Halo portal allows you to perform detailed parametric searches of the Halo database to locate items or sets of items that you may wish to act on. The current release of the reporting service focuses on searching for individual servers or collections of servers that match any of a large number of criteria.
The Reports menu appears in the top menu bar in the Halo portal. Click it to open the Reports page:
Use the search-criteria selectors on this page to set up a search query, and then click Submit to run it. The results of the most recent search are always displayed in the table below the criteria selectors.
You can search for servers using any combination of over 20 criteria. For some of the criteria you enter a text string; for others, you select a value or values from a dropdown list. To select multiple values from a list, select each value separately, by opening the list and clicking the desired value: to remove a selected value, click the small "x" beside the value in the filter.
Search results include a link to the summary page for each server returned.
You can optionally save the results of a search in PDF or CSV format. A PDF report includes just the server fields displayed on the Reports page; a CSV report includes all fields of the server object, as defined in the Servers endpoint of the Halo REST API.
Examples of reports you might generate
For any of these reports, you can further narrow the scope by applying additional filters, such as Group Name, Hostname, Server Label, or a fully qualified domain name—any of which can also be a partial match, allowing you to retrieve, for example, multiple servers by providing a substring that matches more than one hostname.
- Missing or deactivated servers. To list all servers that are no longer sending heartbeats to the analytics engine, use the State filter set to "Missing". To list all servers that have been shut down or whose agents have been stopped, use the State filter set to "Deactivated".
- Servers with out-of-date agent versions. To list all servers whose Halo agent needs to be upgraded, run one or more reports with the Agent Version filter set to a known older version of the agent that you expect may still be running on some servers.
- Agents that may be compromised. To get a quick indication of how wide a suspected attack on Halo agents might be, use the Self Verification Failed filter.
- Servers with a known vulnerability. To list all servers on which a package containing a specific common vulnerability and exposure (CVE) is present, use the CVE Reference Number filter set to that reference number. You can specify more than one CVE in a comma-separated list, to retrieve all servers on which any of the listed vulnerabilities is present.
- Windows servers patched to a specific level. To list all Windows Servers that have been patched to comply with a specific Windows knowledge base article, Use the KB filter set to the ID of the article. Conversely, to list all Windows Servers that have not yet been patched to comply with the knowledge base article, use the Missing KB filter set to the ID of that article.
// <![CDATA[ var pdfTitle="Halo Operations Guide"; var pdfURL="http://www.cloudpassage.com/document_images/ops/halo-operations.pdf"; specifyPDF(pdfTitle, pdfURL); // ]]>