Spectra Detect Dashboard — Analytics, Detections Overview, and Appliance Management

The Spectra Detect Manager (SDM) dashboard shows what's happening across your Spectra Detect deployment. It has the following tabs:

• Analytics: statistics about the files analyzed on connected Workers.
• Appliance Management: the status of SDM and of every connected appliance.

To reload the data on either tab, click Refresh at the top right. For the menus in the header at the top of every SDM page, see SDM Interface.

Configuring the Dashboard

To configure what information you see on the dashboard, go to Administration > Spectra Detect Manager > Dashboard Configuration.

The Enable Central Logging setting decides which tabs the dashboard shows:

• Analytics: available only when central logging is enabled, and then it opens by default. It breaks down the analyzed files by classification, file type and malware family, and shows the total size of all processed files. When central logging is disabled, the tab is greyed out.
• Appliance Management: always available, and the default tab when central logging is disabled. It shows the status of SDM and of every connected appliance.

The same page has other settings that change what the Analytics tab shows:

• Enable Central File Storage also requires central logging. It stores samples on SDM, so the Detailed Analysis column can open them in Spectra Analyze. For more information, see Product Integration with Spectra Analyze.
• Enable Deep Cloud Analysis adds antivirus scan results from Spectra Intelligence to the AV Detections column. For more information, see Detections Overview.
• Subscribe to Cloud Classification Changes turns on notifications about cloud classification changes. For more information, see Notifications.

Analytics

At the top of the Analytics tab, tiles show:

• The number of analyzed files with each classification: Malicious, Suspicious, Goodware and Unknown.
• The total size of all processed files, Size (GB), and the number of Processed files.
• The number of files of each type: Application, Archive, Document, Mobile, Media, E-mail and Other.

Detections Overview

The Detections Overview table lists the files analyzed on connected Workers, and refreshes automatically every 15 seconds. To stop the automatic refresh, for example while you inspect a set of results, click Showing LIVE Results. It changes to LIVE Results Paused; click it again to resume. Moving away from the first page of results also pauses the refresh.

By default, the table shows the Classification, File, Size, File Type, Threat, Scan Date, SHA1 Hash and Detailed Analysis columns. To show or hide columns, click the gear icon in the top right corner of the table, and select or clear them under Show Columns. You can also add the AV Detections, SHA256 Hash, Source and Source Tag columns. File is always shown.

The icon in the Classification column shows the file's risk score. For what each score means, see Risk score. To copy a file name or a hash, click the copy icon next to it.

The Source column shows how a file was submitted: API for files uploaded through the API, or the name of the connector that ingested the file, for example AWS S3, ICAP Server or SMTP. The Source Tag column shows a label you can attach to a file at submission, to identify the line of business, department or other unit it came from. To set it, use the source_tag key in the custom_data parameter of a Usage API upload, or the X-System-Tag header in an ICAP submission. You can filter by both columns, for example to see how many files a department submitted in a given period.

To narrow down the list:

• Select a time range from the drop-down list above the table: Last 24 Hours, Last Week, Last Month, Last Three Months, All Time (default), or Custom.
• Click Show Table Filters to add a row of filters above the columns. You can filter by Classification and Source (drop-down lists), by Size (a range in MB), and by text in File, File Type, Threat, SHA1 Hash, SHA256 Hash and Source Tag. The SHA256 Hash filter appears only when the column is shown. Click Hide Table Filters to remove the row.
• Click a column header to sort the table by that column. An arrow next to the header shows the sort direction.

To download the table as a CSV file, click Export. The export contains the files that match the selected time range and table filters, with their classification, malware details, file name, size and type, processing time, and the Worker that processed them. In the classification column, malicious files are listed as Malware. To keep the input safe, some characters in file names change in the export, for example - becomes [-].

If Deep Cloud Analysis is enabled, the AV Detections column shows how many antivirus scanners detected the file in its latest Spectra Intelligence scan, for example 12/63. To see the scan details, click the dot at the start of the row. The expanded row shows the results of the scanners you selected in Select AV Scanner Results to Display in Detections Overview Preview, up to five, and the following buttons:

• Rescan asks Spectra Intelligence to scan the file again. The button is disabled while the rescan is in progress. Rescanning needs a Spectra Intelligence account that's enabled for the Worker's configuration group, and a quota that includes rescans.
• See All Scans replaces the table with the file's full scan history. To go back to the table, click Back.

If there's no antivirus data for a file, the expanded row says "Antivirus data is not available."

To enable Deep Cloud Analysis and choose the scanners, go to Administration > Spectra Detect Manager > Dashboard Configuration. For more information, see Dashboard Configuration.

Cloud results don't change the classification shown on the dashboard. To have SDM track the classification of analyzed files in Spectra Intelligence, go to Administration > Spectra Detect Manager > Dashboard Configuration, and select Subscribe to Cloud Classification Changes. If a file's classification in Spectra Intelligence changes after the file is analyzed, an icon appears next to its classification in the Classification column. Hover over the icon to see the explanation. To get an up-to-date classification, submit the file for analysis again. Rescan doesn't update the classification, because it only scans the file again in Spectra Intelligence.

Product Integration with Spectra Analyze

The Detailed Analysis column lets you open a file in Spectra Analyze for deeper analysis. Which link it shows depends on how the file gets to Spectra Analyze:

• Spectra Analyze Integration: if it's enabled in Central Configuration > Egress Integrations > Spectra Analyze Integration, Workers upload files to Spectra Analyze directly. The column shows Sample Details, which opens the file's analysis page on Spectra Analyze. This link takes priority over the others, and it stays available after the integration is disabled. Spectra Detect doesn't limit the size of these uploads, but Spectra Analyze does: it rejects files larger than its Administration > Configuration > General > File Size Limit, and the Worker skips them. For more information, see Spectra Analyze Integration.
• Central file storage: if Enable Central File Storage is selected, Workers store files on SDM. To turn it on, go to Administration > Spectra Detect Manager > Dashboard Configuration, and select Enable Central File Storage. The column shows Analyze with Spectra Analyze, which imports the file into Spectra Analyze. After the import, the link changes to Sample Details. This needs central logging, and at least one Spectra Analyze added to SDM in Dashboard > Appliance Management. If several are added, select one from the list. Files larger than the File Size Limit aren't stored, and stored files are deleted after the Sample Retention Period.
• S3: if Workers store files in S3 and know which Spectra Analyze to use, the column shows the same links for those files. To set this up, go to Central Configuration > Egress Integrations > AWS S3, and select Enable S3 File Storage. Then go to Central Configuration > Worker Configuration > General, and enter the Spectra Analyze IP Address or FQDN. If central file storage is also enabled, it takes priority.

Spectra Analyze tags every file imported from SDM with spectra_detect, so you can filter for them there.

If there's no link, the column shows Unavailable. Hover over the question mark next to it to see why:

• "This feature is not enabled.": none of the above is set up.
• "No Spectra Analyze connected.": no Spectra Analyze 8.1 or later is added to SDM.
• "Sample is too large for in-depth analysis.": the file is larger than the File Size Limit.
• "Processing is ongoing…": the file isn't stored yet, or storage was enabled after the file was processed.
• "Sample was erased from central file storage…": the Sample Retention Period has passed.

Processing Timeline

The Processing Timeline chart shows, by date, how many samples were uploaded, processed and postprocessed, and how many failed to analyze. The legend below the chart names the lines: Uploaded, Processed, Postprocessed and Errors. When there's nothing to show, the chart displays No Data Available.

Above the chart, SDM shows how many errors occurred on the connected Spectra Detect appliances during the central logging retention period (90 days by default). To change the period, go to Administration > Spectra Detect Manager > Dashboard Configuration, and set Retention Period. To get the list of files that failed to analyze, click Export Errors / Hashes. This downloads a ZIP file that contains a CSV file with the following columns:

• host_uuid: the ID that a Worker gets automatically when it connects to SDM. To find a Worker's ID, run the conf_centralmanager command on the Worker.
• hostname
• time
• event_type
• task_id
• sample
• container

The export can list one failure more than once. For example, if a processing task fails and that also makes the report upload to S3 fail, the export counts two errors for one event.

Malware Types and Malware Family Count

The Malware Types chart shows the share of each malware type among the analyzed samples, for example PUA, Trojan or Infostealer. The center of the chart shows the total number of samples. Hover over a segment to see the number and percentage for that type.

The Malware Family Count chart shows how many samples belong to each malware family. Hover over a bar to see the exact count.

Appliance Management

The Appliance Management tab shows the status of SDM and of every appliance connected to it. The information refreshes every 5 minutes.

Spectra Detect Manager Status

The bar at the top of the Appliance Management tab shows the status of SDM itself: its Version, and its current CPU, RAM and Disk usage.

To see more details, click anywhere in the bar. This opens the Spectra Detect Manager page, with the following tabs:

• System: the appliance type, status, version, name, operating system description and uptime.
• CPU: the average load over the last minute, for each core and for all cores together.
• Memory: the size and share of physical, used, buffered, cached, shared and available memory.
• Storage: the size, used space and allocation units of each partition.

To download the SDM logs, click Actions > Download Logs on that page.

To upload or download update images, click the version on the right side of the bar, Updated to version. This opens Update Bin Management. For more information, see Managing Update Packages.

Connected Appliances

The Connected Appliances table lists every appliance connected to SDM, with its Type, Version, Group, Status, and its CPU, RAM and Disk usage. The status is, for example, Online, Paused, Offline or Unauthorized.

The Updates column shows the version each appliance was last updated to. Click it to open Update Bin Management. For more information, see Managing Update Packages.

For redundant appliances, the Name column shows more details:

• Hub in a redundant pair: the other Hub, and the role the Hub is acting as.
• Spectra Analyze node in a redundancy cluster: the other node, whether the node is PRIMARY or SECONDARY, and the cluster's application domain, if Spectra Analyze reports one. If the cluster isn't healthy, both nodes show FAILED. The secondary's status is Online.

SDM checks the Spectra Analyze cluster roles every minute, so a switchover shows up within about a minute.

The Yara column shows each appliance's YARA ruleset synchronization status. To turn it on, go to Administration > Spectra Detect Manager > General, and select Enable YARA Ruleset Synchronization. For the secondary node of a Spectra Analyze cluster, the column shows the status of the primary, because the nodes share their YARA rulesets. For more information, see YARA Synchronization.

To pause a Worker, click Pause in the Actions column. A paused Worker finishes the samples it's already processing, but doesn't accept new ones, and its status changes to Paused. This is useful for planned maintenance, upgrades, or temporarily reducing processing capacity. To resume, click Unpause. The Worker starts accepting new samples immediately.

To filter the table, click Show Table Filters. This adds a text filter above each column, so you can filter by several columns at once. To change how many appliances the table shows per page, select 5 rows (default), 10 rows, 20 rows or 100 rows below the table.

Some actions restart SDM or the appliance. Reloading the configuration can take a while, and Workers usually take the longest to restart. The following table shows which actions cause a restart:

Action	Appliance Restart	SDM Restart
Update SDM	No	Yes
Modify settings on SDM	No	Yes
Connect an appliance to SDM	No	No
Authorize an appliance	No	No
Update a connected appliance	Yes	No
Modify settings on the appliance status page	Yes	No
Disconnect an appliance from SDM	No	No

Adding Appliances and Groups

warning

Adding the same appliance to more than one SDM isn't supported, and can cause misconfigurations and conflicts. Before you add an appliance to another SDM, remove it from the first one.

To add an appliance to SDM:

1. Go to Dashboard > Appliance Management, and click Add New Appliance.
2. Under Type, select Spectra Analyze, Spectra Detect Worker or Spectra Detect Hub.
3. Enter a Name that uniquely identifies the appliance, for example "My Appliance".
4. Enter the appliance URL. The URL must use HTTPS. SDM doesn't validate SSL certificates, so make sure the appliance's certificate is valid before you add it.
5. Enter the SNMP Community string. SNMP, the Simple Network Management Protocol, is how SDM gets the appliance's status. The string must match the community string configured on the appliance, or SDM can't show the appliance's status.
6. For a Hub, you can also enter a Load Balancer Password to see load balancer (HAProxy) statistics on the Hub's status page. The password must already be configured on the Hub and on all Workers connected to it.
7. Click Add.

Workers and Hubs are added immediately. For Spectra Analyze, SDM opens the appliance's login page, where you authorize the connection. If authorization doesn't succeed, the appliance is still added, with the Unauthorized status. For more information, see Authorizing Appliances.

If the Spectra Analyze appliance is the secondary node of a redundancy cluster, SDM doesn't open the login page. It authorizes the secondary with the authorization of its primary, within about a minute. For this, add and authorize the primary first, and add the secondary with its IP address in the cluster, or with a host name that resolves to it.

To add a group, click Add New Group, enter a Name, select a Group Type, Configuration Group or Hub Group, and click Add. For more information, see Creating Configuration Groups.

Appliance Status Page

To open an appliance's status page, click the appliance in the Connected Appliances table. The page shows the appliance's system resources and health. At the top of the page, you can:

• For a Worker or Hub, click Upload SSL Certificate to apply a new HTTPS certificate to the appliance.
• Click Edit to change the appliance's name, URL, hostname or SNMP community string. For more information, see Editing and Removing Appliances.
• For the backup Hub of a redundant pair, click Make Primary to swap the roles of the two Hubs. The Make Hub Primary dialog lists the changes: the backup Hub is configured as primary, the primary Hub as backup, and SDM saves and applies the configuration to both Hubs. To confirm, click Continue. On the Hub configured as primary, the button is disabled.
• Open the Actions drop-down list. Which items it shows depends on the appliance type and status:
  • Connectors (authorized, online Hubs with at least one connected Worker) opens the Connectors page, where you configure the connectors that bring files into Spectra Detect. For more information, see Analysis Input.
  • Download Logs downloads a ZIP file with the appliance's system logs, for ReversingLabs Support. While SDM collects the logs, the item shows Retrieving logs.... You can also download the logs with the Download support logs endpoint.
  • Authorization authorizes an appliance that isn't authorized yet. For more information, see Authorizing Appliances.
  • Remove disconnects the appliance from SDM. For more information, see Editing and Removing Appliances.

Hub Redundancy

If the Hub is part of a redundant pair, the page shows its redundancy details under its name:

• Redundant with: the other Hub in the pair. Click its name to open its status page.
• Acting as: the role the Hub currently has, usually PRIMARY or BACKUP. SDM reads it from the Hub through SNMP, so it shows BACKUP until SDM can get the Hub's status. If it stays BACKUP on both Hubs, check SNMP: in Central Configuration > SNMP for the Hub group, select Enable SNMP Service and set the Community. Then, on each Hub's Edit page, set SNMP Community to the same string.
• Configured as: the role set for the Hub in its Hub group.

You can change connectors only on the Hub that's acting as PRIMARY, and SDM syncs the changes to the other Hub. On the other Hub, the Connectors page shows the connectors, but you can't enable, disable, start, pause or save them. If both Hubs show BACKUP, you can't change connectors on either one until SDM can get their status through SNMP.

To make two Hubs a redundant pair, go to Central Configuration, select their Hub group, click Edit group, and set the Secondary Host. For more information, see Central Configuration.

Spectra Analyze Redundancy Clusters

If the appliance is a Spectra Analyze node in a redundancy cluster, the page shows its cluster details under its name:

• Redundant with: the other node in the cluster.
• Acting as: the node's role, PRIMARY or SECONDARY, or FAILED if the cluster isn't healthy.
• Application domain: the cluster's application domain, if Spectra Analyze reports one.

The secondary doesn't answer requests from SDM, so SDM shows the status and version the primary reports for it. To set up a Spectra Analyze cluster, see Redundancy System in the Spectra Analyze documentation.

Status Tabs

If SDM can't get the appliance's status, the page shows a message that statistics are unavailable, and only the appliance type, status and version. Make sure the SNMP community string matches in Central Configuration > SNMP and in the appliance's Edit page.

The information on the page is split into tabs, and refreshes every 5 minutes. Which tabs you see depends on the appliance type:

Tab	Appliance Type	Description
System	All	The appliance type, status, version, name, description and uptime.
CPU	All	The average load over the last minute, for each core and for all cores together.
Memory	All	The size of the physical memory, and the size and share of used, buffered, cached, shared and available memory.
Storage	All	The size, used space, used percentage and allocation units of each partition.
Network	All	The network devices on the appliance: their type, operational and administrative status (up or down), physical address, bandwidth, and the total traffic received and sent.
Queues	Worker, Spectra Analyze	The RabbitMQ queues that background services use to communicate, and the number of messages in each. For Spectra Analyze, the tab also shows each queue's state and number of consumers: every queue should be running and have at least one consumer, a service connected to the queue. For what each Worker queue does, see RabbitMQ Queues.
Processing	Worker	For each interval (1 minute, 10 minutes, 1 hour, 8 hours and 1 day): the number of files and bytes submitted, processed and unpacked, and Queue AVG, the average number of files in the incoming queue.
Load Balancer	Hub	Real-time status of the HAProxy load balancer on the Hub, updated every 10 seconds. Hover over a column name to see what it means. Shows data only if a load balancer password is set for the Hub.
Metrics	Worker	Counts of file processing and post-processing events. For more information, see Metrics.

Metrics

The Metrics tab shows, for the same intervals as the Processing tab, how many files were uploaded to the Worker and sent for analysis, Files Uploaded, and how many events succeeded or failed in each of the following groups:

• Processed: file processing on the Worker.
• S3 Uploads: parent files uploaded to S3.
• Splunk Reports and Callbacks: analysis reports sent to Splunk and to a callback server, if those are configured.

Counts are kept for 24 hours, and each interval counts only the events that happened within it. SDM collects the counts through the Worker service API, but the tab only appears if the SNMP community string is set.

Under heavy load, the counts can be less precise for 2–3 minutes. S3 upload counts include only parent files, not extracted files, so they can be lower than the number of files processed on the Worker.

RabbitMQ Queues

The Queues tab on a Worker's status page lists the RabbitMQ queues that the Worker's services use to pass files to each other. ts-receiver accepts submitted files, ts-preprocessor handles Deep Cloud Analysis, ts-worker analyzes files with Spectra Core, and ts-postprocessor handles the results. The Worker always uses the tiscale.hagent queues. It uses the tiscale.preprocessing queues only when Deep Cloud Analysis is enabled, so they might not appear otherwise.

Queue	Description
tiscale.hagent_error	Files whose processing was interrupted twice, for example by a crash or timeout: first from tiscale.hagent_input, and again from tiscale.hagent_retry. ts-postprocessor handles them.
tiscale.hagent_input	Files waiting for analysis by ts-worker. The results go to tiscale.hagent_result, including failed analyses. If processing is interrupted, the file moves to tiscale.hagent_retry.
tiscale.hagent_result	Analysis results from ts-worker, successful and failed, waiting for ts-postprocessor.
tiscale.hagent_retry	Files whose processing was interrupted, and files larger than the large file threshold when large file processing is enabled. The results go to tiscale.hagent_result. If processing is interrupted again, the file moves to tiscale.hagent_error.
tiscale.hagent_url	URL and container image submissions. ts-receiver downloads the file, then sends it to Deep Cloud Analysis preprocessing, if enabled. Otherwise, it sends large files to tiscale.hagent_retry and the rest to tiscale.hagent_input.
tiscale.preprocessing	Files waiting for Deep Cloud Analysis: ts-preprocessor uploads them to Spectra Intelligence for antivirus scanning and subscribes to the results. Then the file goes to tiscale.preprocessing_dispatcher if the Worker waits for antivirus results, and otherwise to tiscale.hagent_input, or to tiscale.hagent_retry for large files.
tiscale.preprocessing_dispatcher	Files waiting for antivirus scan results. The file stays in the queue until the results arrive or the wait times out, then goes to tiscale.hagent_input, or to tiscale.hagent_retry for large files.
tiscale.preprocessing_unpacker	Files to unpack before Deep Cloud Analysis, when Scan Unpacked Files is selected in the Spectra Intelligence configuration. A ts-worker unpacks them, then sends them to tiscale.preprocessing.

Editing and Removing Appliances

To edit an appliance:

1. Go to Dashboard > Appliance Management, and click the appliance in the Connected Appliances table.
2. On the appliance status page, click Edit.
3. On the Configure Appliance page, change the Name, URL, Hostname or SNMP Community as needed. The URL must use HTTPS. For a Hub, you can also set the Load Balancer Password.
4. Click Save. To go back without saving, click Cancel.

To remove an appliance, open its status page, click Actions > Remove, and click Remove in the confirmation dialog. Remove an appliance while it's online. SDM then tells the appliance that it's no longer connected. If the appliance is offline, SDM still removes it from the list, but the appliance isn't told, and still considers itself connected to SDM. To replace an appliance, remove it and add the new one, instead of changing its URL. On Kubernetes deployments, Workers and Hubs can't be removed from SDM.

Authorizing Appliances

SDM authorizes Workers and Hubs automatically right after you add them. A Spectra Analyze appliance has to be authorized on the appliance itself, except for the secondary node of a redundancy cluster, which SDM authorizes through its primary. Until an online appliance is authorized, its Status in the Connected Appliances table is Unauthorized. For more information, see Adding Appliances and Groups.

To authorize an appliance, open its status page and click Actions > Authorization. For Spectra Analyze, this opens the authorization page on Spectra Analyze. For a Worker or Hub, SDM repeats the automatic authorization.

A Worker or Hub shows Unauthorized if the automatic authorization didn't finish when it was added, or if the appliance later rejects SDM's credentials.

Enabling Appliances Search on Spectra Analyze

If several Spectra Analyze appliances are connected to and authorized on the same SDM, you can search for samples on all of them at once, from any of them. You can search by file name or by hash, and mix hash types, for example MD5 and SHA1, in one query. The results link to the samples on each appliance. If an appliance can't be reached, or the search fails on it, a notification tells you which one.

To enable Appliances Search on a Spectra Analyze appliance, go to Administration > Configuration > Spectra Detect Manager on that appliance, and select Enable Appliances Search. For more information, see Spectra Detect Manager in the Spectra Analyze documentation.