Data Forensics - Queries and Reports
Introduction
Data Forensics in Superna Data Security Edition provides detailed insight into user activity and data access patterns across your storage environment. It enables security teams to investigate incidents, analyze historical behaviors, and generate reports for audit or compliance use.
Using the Queries and Reports features, you can track file-level activity, detect suspicious access trends, and build structured reports to support forensic analysis and incident response workflows.
This section explains how to create, edit, and manage queries and reports in the Easy Auditor interface, with platform-specific details for VAST and Qumulo.
- VAST
- Qumulo
Features Available for VAST Users
Queries for VAST
| Feature | Availability |
|---|---|
| Report Query Builder | ✔️ Available |
| Saved Queries | ✔️ Available |
| Built-in Queries | ❌ Not Available |
Reports for VAST
| Feature | Availability |
|---|---|
| Finished Reports | ✔️ Available |
| Running Reports | ✔️ Available |
| Report Schedule | ✔️ Available |
Other Options for VAST
| Feature | Availability |
|---|---|
| Active Auditor | ✔️ Available |
| Where Did My Folder Go | ✔️ Available |
| Wiretap | ❌ Not Available |
| RoboAudit | Coming Soon |
| Bulk Ingest | Coming Soon |
Features Available for Qumulo Users
Queries for Qumulo
| Feature | Availability |
|---|---|
| Report Query Builder | ✔️ Available |
| Saved Queries | ✔️ Available |
| Built-in Queries | ❌ Not Available |
Reports for Qumulo
| Feature | Availability |
|---|---|
| Finished Reports | ✔️ Available |
| Running Reports | ✔️ Available |
| Report Schedule | ✔️ Available |
Other Options for Qumulo
| Feature | Availability |
|---|---|
| Active Auditor | ✔️ Available |
| Where Did My Folder Go | ✔️ Available |
| Wiretap | ❌ Not Available |
| RoboAudit | Coming Soon |
| Bulk Ingest | ❌ Not Available |
Queries and Reports Steps
Login to the Superna Dashboard
Access the Eyeglass Web UI via https://<Eyeglass IP address>.
Login using the default credentials provided for new deployments.
How to Create a Query
Steps to Create a Query
- Navigate to Eyeglass GUI.
- Go to Easy Auditor.
- Select Report Query Builder.
- Enter what you want to search for.
- Click "Run Report Using Query".
How to Edit a Query
Steps to Edit a Query
- Navigate to Eyeglass GUI.
- Go to Easy Auditor.
- Select Saved Queries.
- Choose the query you wish to edit.
- Select Query Actions.
- Load Query into Query Builder.
How to Create a Report
Building a query spits out a report that ends up in Finished Reports.
How to Review the List of Queries and Reports
Steps to Review Queries and Reports
- Navigate to Eyeglass GUI.
- Go to Easy Auditor.
- Select Saved Queries or Finished Reports.
How to Delete a Query
Steps to Delete a Query
- Navigate to Eyeglass GUI.
- Go to Easy Auditor.
- Select Saved Queries.
- Delete the query.
