VMware Carbon Black

During Big Room Planning (BRP), it was decided by an Agile team that it was time to build the long-sought feature of Data Export, for the Alerts page and Investigate page. Additionally, one of our largest customers, a global technology company, had been pushing for us to add the feature, starting with the Investigate page. We would now have to figure out why the rest of our customers would want this feature, and how they would use it.

Operating in a SAFe Agile environment meant that we had little time to spare. In order to get a jump start on our design process, I moderated a UX Roundtable - a focus group of our customer-facing colleagues, such as Sales Engineers, who work with customers every day. The discussion included generative questions, along with a review of wireframes.

Key Takeaways:

• There is a strong demand for the Data Export feature
• CSV is the preferred format for exported data
• The use of Notifications to convey that an export is ready was not popular
• A queue page is needed in order to monitor status of an export
• The Inbox is an ideal place for the exports to permanently live
• The 50,000 records size limit is acceptable

After validating our design direction with our customer-facing teams, we embarked on a mixed-method study, consisting of user interviews and usability testing. Five customers took part in our study test.

"I'm underwhelmed by the data in the expansion"

"No, I'm sorry - I don't understand the URL"

Key Findings

Investigate Page

1. All participants were able to find the Export button
   1. 3/5 would use the Export button on a weekly basis
   2. 3/5 would use an export for targeted investigations
   3. 2/5 would use it to import data into other systems
2. All participants understood the Export button hover text
   1. 4/5 remembered that the results would appear in Notifications when they were ready to download

1. Export Exceeded Limit modal text caused confusion
   1. 2/5 stated it was unclear as to whether it would be sorted by time of event or device name
   2. 2/5 thought that the text does not convey what will happen if the Continue button is clicked

1. All participants understood the text provided in Notifications
2. All participants would download the export straight from Notifications, rather than navigating to the Inbox

1. The Inbox does not provide any information on the criteria or timeframe that the export was based on 
   1. All participants expected that expanding the chevron would reveal the export parameters
   2. 3/5 thought that showing the event sequence was unnecessary 
2. There is no way to stop an export after it has been run
   1. 3/5 expected to be able to stop an export on the Inbox page
3. The amount of information in the Inbox can become overwhelming 
   1. 3/5 said that they needed additional ways to filter or categorize data in the Inbox, as some contain hundreds of thousands of messages
4. All participants were able to find, download and view the CSV file
   1. 4/5 would use the CSV file for targeted investigations
   2. 1/5 would use the CSV file for compliance reporting

1. The search definition provided no visibility into the export parameters
   1. 4/5 could no understand the search definition (URL) that was provided
   2. 3/5 viewed having the export parameters as essential

Investigate Page

Export Modal

Notifications

Inbox Page

CSV File

Conducting the Data Export research was an enjoyable experience. The functionality was something that our customers were demanding and it was astonishing that this capability wasn't already available, in such a sophisticated application. Hearing the excitement and relief in customers' voices, once they knew it was on the way, was gratifying.