Cloud Excel Addin - data export and report

[Flyers2020 0]

are there plans for integrated reporting in Nebula? Similar to how you have made this add-in.

[Lee-Wei 2]

7 minutes ago, Flyers2020 said:

are there plans for integrated reporting in Nebula? Similar to how you have made this add-in.

I don't know the plans. One way to provide feedback is that when you sign into the Nebula cloud console, the bottom left corner has a "Send Feedback" feature to send your query and feedback.

[noogie 1]

I am seeing discrepancies between the Excel Add-in and the console.  The total number of threat detections are off.  (For Ex: Looking at Detections, I see 99 from the cloud console and 35 from Excel.  I am running this using the same custom date criteria)   Am I doing something wrong?  I am running Excel Add-In v3.1.1.  

[Lee-Wei 2]

14 minutes ago, noogie said:

I am seeing discrepancies between the Excel Add-in and the console.  The total number of threat detections are off.  (For Ex: Looking at Detections, I see 99 from the cloud console and 35 from Excel.  I am running this using the same custom date criteria)   Am I doing something wrong?  I am running Excel Add-In v3.1.1.  

From my recollection, there are 2 possibilities:

- Firstly, in the Excel Add-in, the detection data is filtered based on the Endpoints selected. For example, if you download a subset of endpoints from a group, then the detections will be filtered based on that set of assets.

- Secondly, I am not sure on this one. At one point, the console only shows 30 days of threat data, whereas the Excel Add-in via the API has access to 90 days of threat data. So check your console to see the oldest dates.

[noogie 1]

8 minutes ago, Lee-Wei said:

From my recollection, there are 2 possibilities:

- Firstly, in the Excel Add-in, the detection data is filtered based on the Endpoints selected. For example, if you download a subset of endpoints from a group, then the detections will be filtered based on that set of assets.

- Secondly, I am not sure on this one. At one point, the console only shows 30 days of threat data, whereas the Excel Add-in via the API has access to 90 days of threat data. So check your console to see the oldest dates.

@Lee-Wei  Thank you for your quick response.  Not sure if I was not clear.  So on the console, Under the Report section, I created a Detections Summary report with a custom (On-Demand) date.  I am comparing the total threat count with the Detection report generated by the Add-In and using same custom dates.  I don't see where there is an ability to filter endpoints if this is the case.

[Lee-Wei 2]

12 minutes ago, noogie said:

@Lee-Wei  Thank you for your quick response.  Not sure if I was not clear.  So on the console, Under the Report section, I created a Detections Summary report with a custom (On-Demand) date.  I am comparing the total threat count with the Detection report generated by the Add-In and using same custom dates.  I don't see where there is an ability to filter endpoints if this is the case.

In the Excel Add in, if you have imported any Endpoints unto the spreadsheet, then the Detection import will automatically filter against that set of endpoints.

If you simply perform a Detection import, then no additional filtering will apply.

Since the data set is not too big (35 - 99), would you mind just spot check to see which are the missing ones?

Failing that, feel free to contact me and I do a quick check with you. My email is leewei at leewei dot com.

[noogie 1]

1 hour ago, Lee-Wei said:

In the Excel Add in, if you have imported any Endpoints unto the spreadsheet, then the Detection import will automatically filter against that set of endpoints.

If you simply perform a Detection import, then no additional filtering will apply.

Since the data set is not too big (35 - 99), would you mind just spot check to see which are the missing ones?

Failing that, feel free to contact me and I do a quick check with you. My email is leewei at leewei dot com.

On the Excel Add-In and in the "Detections and Threats" button is there a difference between the "Import Data" and Import Data and Generate Reports" button"?   Interestingly enough the "Import Data" button shows the correct (same) number as I see on the console.  The "Import Data and Generate Reports" button shows the discrepancy.  

[Lee-Wei 2]

28 minutes ago, noogie said:

On the Excel Add-In and in the "Detections and Threats" button is there a difference between the "Import Data" and Import Data and Generate Reports" button"?   Interestingly enough the "Import Data" button shows the correct (same) number as I see on the console.  The "Import Data and Generate Reports" button shows the discrepancy.  

Hmm, no there should not be a difference the the number of detections, because it is the same code. After importing the data, the "...Generate Reports" further creates some charts for us.

Private message me or contact me via my email above and I can take a look.

 

[Lee-Wei 2]

@noogie, 

Oh silly me, the reason for the difference is that the Excel Add-in is “Aggregating” the detections.

When Malwarebytes detect a threat, the console is showing the “traces”.

So one threat, such as a PUP, might have multiple traces consisting of files, registries, etc.

The Excel Add-in defaults to aggregating them.

Go to Configuration and Options and check the following “Do not aggregate Detections” to show all traces without aggregating them.

 

[noogie 1]

1 hour ago, Lee-Wei said:

@noogie, 

Oh silly me, the reason for the difference is that the Excel Add-in is “Aggregating” the detections.

When Malwarebytes detect a threat, the console is showing the “traces”.

So one threat, such as a PUP, might have multiple traces consisting of files, registries, etc.

The Excel Add-in defaults to aggregating them.

Go to Configuration and Options and check the following “Do not aggregate Detections” to show all traces without aggregating them.

 

I made the change but the numbers still do not match.  Actually reporting higher now on the AddIn.  I think I may be interpreting these reports incorrectly.  I’m looking at the Console generated “Detections Summary” numbers and the “Weekly Security” report numbers.  Both these reports match but I am not seeing the same numbers on the AddIn.  
(Btw - i sent you an email with some screenshots.  Hope that helps)

[noogie 1]

On 12/17/2020 at 12:54 AM, noogie said:

I made the change but the numbers still do not match.  Actually reporting higher now on the AddIn.  I think I may be interpreting these reports incorrectly.  I’m looking at the Console generated “Detections Summary” numbers and the “Weekly Security” report numbers.  Both these reports match but I am not seeing the same numbers on the AddIn.  
(Btw - i sent you an email with some screenshots.  Hope that helps)

@Lee-Wei  I entered different week ranges and am getting the matching threat counts.   I'm not sure why that particular week showed differences but as long as it looks good now.     Thank you for your help again!  This tool is awesome btw!   

[JeremyIIA 0]

Hi guys,

fairly new to the excel add-in. I've already rebooted my machine and was able to connect to my nebula console but when I try and import my endpoint data I'm getting two errors. 

 

1. Unable to get the Add property of the Sheets class

2.Unable to set the DisplayGridlines property of the Window class. 

 

I have a nebula account

using excel 2013

and have .net 4.8 installed. 

[AdvancedSetup 586]

Not sure of the required details but perhaps @Lee-Wei can assist.

 

[MCJones 0]

Hi,

I am interested in using this Add-In however I am stumbling at the first hurdle.   I have installed the Add In (v3.1.1).   When I attempt to sign in the the cloud I get a 407 Proxy error message:

I normally sign into the cloud successfully with these credentials (although use 2FA) at the following URL:

https://cloud.malwarebytes.com/dashboard

Any assistance would be welcome.

Kind regards,

Mike

[Lee-Wei 2]

4 hours ago, MCJones said:

Hi,

I am interested in using this Add-In however I am stumbling at the first hurdle.   I have installed the Add In (v3.1.1).   When I attempt to sign in the the cloud I get a 407 Proxy error message:

I normally sign into the cloud successfully with these credentials (although use 2FA) at the following URL:

https://cloud.malwarebytes.com/dashboard

Any assistance would be welcome.

Kind regards,

Mike

@MCJones Hi Mike, I don't think the add-in supports proxy connection, which I would you assume you are using.

I will have to look into adding that.

[Lee-Wei 2]

On 1/13/2021 at 7:42 AM, JeremyIIA said:

Hi guys,

fairly new to the excel add-in. I've already rebooted my machine and was able to connect to my nebula console but when I try and import my endpoint data I'm getting two errors. 

 

1. Unable to get the Add property of the Sheets class

2.Unable to set the DisplayGridlines property of the Window class. 

 

I have a nebula account

using excel 2013

and have .net 4.8 installed. 

@JeremyIIASorry that I missed your post earlier. If you contact me directly, I would be very interested in debugging the error.

[RickyF 0]

Hi @LeeWei,

I have a problem. 

When import my site to a new Excel file only the default group devices are imported. Every thing else is ignored

Can you help?

Thanks

Ricky

[Lee-Wei 2]

18 minutes ago, RickyF said:

Hi @LeeWei,

I have a problem. 

When import my site to a new Excel file only the default group devices are imported. Every thing else is ignored

Can you help?

Thanks

Ricky

@rickyf Can you please tell me more what function/button are you clicking. A picture will be useful, as I cannot picture the error.

[RickyF 0]

Ok,

1.- I have in my my site two groups. default and BNL (see my 1 capture)

2.- I open excel plug in and connect to the site

3.- I select to import ALL groups (not just the default group)

4.- only the default group is imported and the BNL group is ignored

[Lee-Wei 2]

@rickyf Thanks for the pictures and I can the issue you are facing.

I cannot think of a reason - might have to do with login user and the group permission?

I logged into a OneView site with more than one group and i do see all the endpoints from 2 different groups.

[RickyF 0]

What do you recommend? What can I do to solve the problem. Any tips 

ricky 

[Lee-Wei 2]

On 5/9/2021 at 12:02 PM, RickyF said:

What do you recommend? What can I do to solve the problem. Any tips 

ricky 

Ricky and I worked together and turned out that we were using a Read Only user account that does not have rights to the other groups.

Once we correct the user permission, we are able to import and view the endpoints correctly.

 

[RickyF 0]

Yes. Thanks Lee. Without your help It would have been impossible to fix it

best

ricky