Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Managing Simulation Results

 

After a simulation runs, the Results column displays a drop-down list containing a list of the dates when the simulation was generated.

Simulation results are retained for 30 days. Results only display in the Results column after a simulation runs.

Viewing Simulation Results

You can view simulation results in the Results column of the Simulations page.

Results only display in the Results column after a simulation runs. Simulation results provide information on each step of the simulation.

For example, the first step of a simulation provides a list of the directly connected assets that are affected by the simulation. The second step lists assets in your network that can communicate to first-level assets in your simulation.

When you click View Result, the following information is provided:

Table 1: Simulation Result Information

Parameter

Description

Simulation Definition

The description of the simulation.

Using Model

The name of the model against which the simulation was run.

Simulation Result

The date on which the simulation was run.

Step Results

The number of steps for the result that includes the step that is being displayed.

Assets Compromised

The total number of assets that are compromised in this step and across all simulation steps.

If the topology model includes data from an IP range of /32 defined as reachable, then JSA Risk Manager does not validate those assets against the database. Therefore, those assets are not considered in the Asset Compromised total. JSA Risk Manager only validates assets in broader IP ranges, such as /24 to determine which assets exist.

Risk Score

Risk score is a calculated value based on the number of results, steps, the number of compromised assets, and the importance factor that is assigned to the simulation. This value indicates the severity level that is associated with the simulation for the displayed step.

You can move your mouse pointer over a connection to determine the list of assets that are affected by this simulation.

The top 10 assets display when you move your mouse over the connection.

Move your mouse pointer over the connection to highlight the path through the network, as defined by the subnet.

The simulation result page provides a table called, Results for this step. This table provides the following information:

Table 2: Results for This Step Information

Parameter

Description

Approve

Allows you to approve simulation results. See Approving simulation resultsIn simulations, you can approve network traffic that is deemed low risk or normal communication on the asset. When you approve results, you filter the result list so that future simulations ignore these approved communications..

Parent

The originating IP address for the displayed step of the simulation.

IP

The IP address of the affected asset.

Network

The network of the target IP addresses, as defined in the network hierarchy.

Asset Name

The name of the affected asset, as defined by the asset profile.

Asset Weight

The weight of the affected asset, as defined in the asset profile.

  1. Click the Risks tab.
  2. On the navigation menu, select Simulation >Simulations.
  3. In the Results column, select the date and time of the simulation you want to view using the list.
  4. Click View Result. You can view the simulation result information, starting at step 1 of the simulation.
  5. View the Results for this Step table to determine the assets that are affected.
  6. To view the next step of the simulation results, click Next Step.

Approving Simulation Results

In simulations, you can approve network traffic that is deemed low risk or normal communication on the asset. When you approve results, you filter the result list so that future simulations ignore these approved communications.

You can approve simulation results.

Results are only displayed in the Results column after a simulation runs.

  1. Click the Risks tab.
  2. On the navigation menu, select Simulation >Simulations.
  3. In the Results column, select the date and time of the simulation that you want to view by using the list.
  4. Click View Result.
  5. In the Results for this step table, use one of the following methods to approve assets:

    Option

    Description

    Approve Selected

    Click the check box for each asset that you want to approve, and then click Approve Selected.

    Approve All

    Click Approve All to approve all assets that are listed.

  6. Click View Approved to view all approved assets.

Revoking a Simulation Approval

You can revoke an approved connection or communication from a simulation approved list. When an approved simulation result is revoked, any future simulations display non-approved communications in the simulation results.

  1. Click the Risks tab.
  2. On the navigation menu, select Simulation >Simulations.
  3. In the Results column, select the date and time of the simulation you want to view using the list.
  4. View Result.
  5. Click View Approved to view all approved assets.
  6. Choose one of the following options:

    Option

    Description

    Revoke Selected

    Click the check box for each asset that you want to revoke, and then click Revoke Selected.

    Revoke All

    Click Revoke All to revoke all the assets that are listed.