Home
Guardian
Learn how Guardian provides comprehensive asset inventory and network visibility for OT and IoT environments.
User Guide
Information and resources about the main features of Guardian, and the tasks that you can do from the user interface (UI).
Queries
You can use the Nozomi Networks Query Language (N2QL) syntax to create complex data processes to obtain, filter, and analyze lists of information from the Nozomi Networks software.
Examples
Column chart
An example on how to create a column chart with the top nodes by traffic.

Guardian
Learn how Guardian provides comprehensive asset inventory and network visibility for OT and IoT environments.
- Introduction
  An overview of Guardian.
- Installation Guide
  Information and resources on how to install Guardian, and the different options and settings that are available.
- Administrator Guide
  Information and resources about the Administration section of Guardian, and the tasks that you can do in this part of the software.
- User Guide
  Information and resources about the main features of Guardian, and the tasks that you can do from the user interface (UI).
  - Sensors
    The Sensors page lets you view all of the sensors that you have in your system.
  - Alerts
    The Alerts page shows all the latest alerts in the system. It lets you view the alerts in different modes, and carry out actions on the alerts.
  - Assets
    The Assets page shows all the physical components and systems in the local network environment and their associated details. It also lets you perform actions on those assets. Depending on the nodes and components involved, assets can range from a simple personal computer to an operational technology (OT) device.
  - Queries
    You can use the Nozomi Networks Query Language (N2QL) syntax to create complex data processes to obtain, filter, and analyze lists of information from the Nozomi Networks software.
    - Data sources
    - Basic operators
    - Commands
    - Functions
    - Examples
      - Pie chart
        An example on how to create a pie chart to understand the media access control (MAC) vendor distribution in a network.
      - Column chart
        An example on how to create a column chart with the top nodes by traffic.
      - Where with multiple conditions in OR
        An example of a query to get all the nodes with a specific role, in particular all the nodes which are web or domain name server (DNS) servers.
      - Bucket and history
        An example of a query to calculate the distribution of link events towards an internet protocol (IP) address.
      - Join
        An example query to join two data sources to obtain a new data source with more information. In particular, how to list the links with the labels for the source and destination nodes.
      - Compute the availability history
        An example query to compute the availability history for a link.
      - Complex field types
  - Smart Polling in Guardian
    The Smart Polling page lets you view and manage Smart Polling.
  - Arc in Guardian
    Arc™ is a host-based sensor that detects and defends against malicious or compromised endpoints, and insider attacks. You can use Arc sensors to aggregate data for analysis and reports, either on-premises, or in the Vantage cloud.
  - Network
    The Network page gives you access to multiple pages that show nodes, links, sessions in tabular format and graphs and traffic in a graphical format.
  - Graph
    The Graph pages gives a graphical representation of the nodes in the environment.
  - Process
    Process is a set of repeatable functions that a business does to deliver a core value.
  - Reports
    The Reports page lets you manage, generate, schedule and view reports.
  - Assertions
    The Assertions page shows all the assertions and lets you configure them.
  - Time machine
    Time machine lets you load a snapshot, which is a previously saved state, and go back in time, to analyze the data from a past situation. You can load a single snapshot and use the platform as usual or load two snapshots and compare the user interface to highlight changes.
  - Vulnerabilities
    The Nozomi Networks software continuously discovers vulnerabilities in monitored assets.
  - Administration
  - Personal settings
    The personal settings page lets you do actions that are specific to your profile.
- Maintenance Guide
  Information about the maintenance tasks of Guardian, to help you administer and maintain the solution in a production environment.
- Print format documentation
  A list of all the print-format documentation that is available for Guardian.

Column chart

An example on how to create a column chart with the top nodes by traffic.

To start, you need to get the nodes and select the:

id
sent.bytes
received.bytes
sent.bytes
received.bytes

To calculate the sum , you need to use the sum function. The query is:

nodes | select id sent.bytes received.bytes sum(sent.bytes,received.bytes)

When you execute this query, the sum field has a very long name. You can rename it to be more comfortable with these commands:

nodes | select id sent.bytes received.bytes sum(sent.bytes,received.bytes)->sum

To obtain the top nodes by traffic, you can sort and take the first 10:

nodes | select id sent.bytes received.bytes sum(sent.bytes,received.bytes)->sum | sort sum desc | head 10

Finally, to display the data in a graphical way, you can use the column command:

nodes | select id sent.bytes received.bytes sum(sent.bytes,received.bytes)->sum | sort sum desc | head 10 | column id sum sent_bytes received_bytes

Note:

You can access an inner field of a complex type with the dot syntax, in the example the dot syntax is used on the fields sent and received to access their bytes sub field.

Note:

After accessing a field with the dot syntax, it will gain a new name to avoid ambiguity; the dot is replaced by an underscore. In the example sent.bytes become sent_bytes

Column chart example — Figure 1. Column chart example