Filtering nodes on the network map

Expand all | Collapse all

By default, the network map displays all nodes that have communicated during the defined time period. To limit the number of nodes displayed on the network map, you can use the following functions:

• Filtering by asset status

  To filter nodes on the network map based on the statuses of assets:

  1. In the toolbar located above the network map, open the Asset statuses drop-down list.

     You will see a list containing the names of statuses for assets that are known to the application (Unauthorized, Authorized, Archived), and the Unknown device status for devices that are unknown to the application.

  2. In the drop-down list, select the check boxes for the statuses of assets that need to be displayed on the network map.
  3. Click OK.

  The network map displays only those nodes that represent assets with the selected statuses.

• Filtering by asset security state

  To filter nodes on the network map based on the security states of assets:

  1. In the toolbar located above the network map, open the Asset states drop-down list.

     You will see a list containing the names of security states for assets (OK, Warning, Critical events).

  2. In the drop-down list, select the check boxes for the security states of nodes that need to be displayed on the network map.
  3. Click OK.

  The network map displays only those nodes that represent assets with the selected security states.

• Filtering by asset category

  To filter nodes on the network map based on the categories of assets:

  1. In the toolbar located above the network map, open the Asset categories drop-down list.

     You will see a list containing the names of categories for known assets, as well as individual categories for unknown devices and WAN nodes.

  2. In the drop-down list, select the check boxes for those categories of assets that need to be displayed on the network map.
  3. Click OK.

  The network map displays only those nodes that represent the selected categories of assets.

After applying a filter, the network map displays only those nodes that satisfy the defined filter settings. In addition, for a node to be displayed on the network map, it must have a connection (link) with another displayed node. If the defined filter settings cause the network map to not display all nodes with which a node has interacted, this node is also not displayed on the network map. Filtering is applied similarly for nodes that are part of a consolidated node of unknown devices: if the network map does not display all nodes with which a node of an unknown device has interacted, this node is removed from the list of nodes within the consolidated node of unknown devices.

If necessary, you can enable the network map to display all nodes associated with filtered nodes. Together with nodes that satisfy the defined node filter settings, the network map will also display all nodes with which interactions have occurred (irrespective of the defined filter settings).

For example, if node filtering by PLC category is enabled and you have enabled the display of linked nodes, the network map will display all nodes with which PLC category assets have communicated. If the display of linked nodes is disabled, the network map will display nodes of only those PLC category assets that have communicated with each other.

To enable or disable the display of nodes associated with filtered nodes:

Use the Linked assets toggle switch in the toolbar located above the network map.

Page top