Creating Baseline Filters - PAS ICS Integrity - 7.3 - Administration & Configuration - Intergraph

ICS Integrity Administration Guide

Language
English
Product
PAS ICS Integrity
Subproduct
ICS
Search by Category
Administration & Configuration
PAS Version
7.3

Before you can create a baseline, you need to create and apply baseline filters for each baseline type you created. A baseline filter starts with a saved query you created, essentially identifying a subset of existing data. You can adjust the filters to decide exactly what data, and from where, to include in each baseline type.

Baseline filters allow you to add object types to a baseline type. For example, you can include Alarms and Tags in the Safety Critical baseline type. In addition, you can configure the filter to include just the properties that you select for an object type. Configuring the filter this way excludes all other properties for that object that you do not want to include in your baseline.

Once you define the baseline filters in each baseline type, you then create a baseline by assigning one or more assets to a baseline type.

  • You can create multiple filters for the same object type, and each filter can use any of the object properties. You can also have multiple filters referring to the same property of an object.

  • If you remove a property from a filter or the source of the import, and that property is referenced in another filter, you need to edit all the filters to not include that property. If you do not edit the filters that reference that property, you will see deviations as the baseline filter looks for changes.

To add baseline filters:

  1. Open the Asset Model Development Kit. To open the AMDK, run the following file: InstallPath\DataCollector\AMDK.exe

  2. Click Baselines > Baseline Type Definition.

  3. Select the Baseline Type and the Asset Model you want to create a baseline for.

  4. In the Filters section of the Baseline Definition window, click the Add (+) button.

    admin-cyber-baseline-filter-new

  5. Type a name in the Filter name field.

    The Asset Model field is set to the Asset Model selected in the Baseline Type Definition window. This field cannot be edited when adding a new filter.

  6. Click Load from Saved Query.

    admin-cyber-baseline-filter-query

    Clicking the Load from Saved Query button overrides existing properties in the window.

  7. If you want to add property data from a query you created in the Integrity web interface, complete the following steps:

    1. On the Add QueryDef window, select Property Data as the Query Type to select existing property data to add to the filter, and then click Add.

    2. Click the Edit button. The Add/Remove Properties window is displayed.

    3. If you want to remove a property, select the property in the Existing Property Names list, and then click the delete button.

    4. If you want to add a property, type the property name in the Enter New Property Names list, and then press the add button. You can add multiple properties in the list by pressing the Enter key after each property name.

    5. If your baseline filter uses only the File image property of the object type, add the OUID property to the Existing Property Names list to avoid the common properties for the object type getting included in the baseline object, which causes the creation of unnecessary deviations.

    When no existing property names are specified, the baseline object uses the common properties for that object type. Include the OUID property when the image property is required.

    admin-cyber-baseline-filter-prop

    1. Click Save to close the Add/Remove Properties window.

  8. If you want to add reference data from a query you created in the Integrity web interface, complete the following steps:

    1. On the Add QueryDef window, select Reference Data as the Query Type to select existing reference data to add to the filter, and then click Add.

    2. Click the Edit button. The Add/Remove Reference window is displayed.

    3. If you want to add references, select one or more references on the left, and the click the right arrow (>) button.

    4. If you want to remove references, select one or more references on the right, and then click the left arrow (<) button.

    5. e.Click Save to close the Add/Remove Properties window.

    The Object Type and Properties fields populate with the information from the query.

  9. Click Save.