Managing reports

Edit online

Reports are a core capability that you use to evaluate the current security posture of your infrastructure. QRadar® EDR provides you with an editable report that contains information about the latest developments.

Important: There is a known issue that can cause QRadar EDR to continuously send reports to the recipient who no longer has an instance of QRadar EDR. For more information, see technote 7058243.

Creating scheduled reports

Edit online

Procedure

  1. Click Reports.
  2. Click Create Scheduled Report.
    The Create Scheduled Report page opens.
  3. Enter a Name and Description for your report.
  4. If you're in an MSSP environment, select the target clients or groups for your report.

    If you select a client, all groups within the client are included in the report.

  5. Set the schedule for the report.
    The report is generated on the days that you selected at 00:00 in the specified time zone.
  6. If you want to add a logo to your report, click Report logo and add an image.
    Tip: The image must be a .jpg, .png, or .svg file, and no larger than 2 Mb. The suggested size of the image is 400® x 300 px.
  7. If you want to automatically send an email message with the report to other people, click Automatically send to.
    1. Enter the email addresses of the recipients in the Enter your emails here field.
      The email message is sent with these email addresses in the BCC field so that they addresses are not exposed to other recipients.
    2. Enter your email message in the text box.
  8. If you want to be notified when the report is ready, select Notify me when a new report is ready.
  9. Click Create.

Pausing a scheduled report

Edit online

Procedure

  1. Click Reports.
  2. Set the Active toggle for a report to the off position.

Viewing a scheduled report

Edit online

Procedure

  1. Click Reports.
  2. Click a report in the reports list.
  3. On the Reports tab, click View.

Editing a scheduled report

Edit online

Procedure

  1. Click Reports.
  2. Click a report in the reports list.
  3. On the Reports tab, click View.
  4. Click Edit.
  5. Add or update the Executive Summary for the report.
  6. Remove any unneeded widgets from the report.
  7. Apply any detection strategy or alert filters that are needed to customize the report.
  8. Click Finish Editing.

Exporting a scheduled report

Edit online

Procedure

  1. Click Reports.
  2. Click a report in the reports list.
  3. On the Reports tab, click View.
  4. Click Export.

Deleting a scheduled report

Edit online

Procedure

  1. Click Reports.
  2. Click a report in the reports list.
  3. Click Remove.

Creating ad hoc reports

Edit online

Procedure

  1. Click Reports.
  2. Click Ad Hoc Reports.
  3. Click Create Ad Hoc Report.
  4. Enter a Name and Description for your report.
  5. If you're in an MSSP environment, select the target clients or groups for your report.

    If you select a client, all groups within the client are included in the report.

  6. Set the Starting date and Timezone for the report.
  7. If you want to add a logo to your report, click Report logo and add an image.
    Tip: The image must be a .jpg, .png, or .svg file, and no larger than 2 Mb. The suggested size of the image is 400 x 300 px.
  8. Click Create.

Viewing an ad hoc report

Edit online

Procedure

  1. Click Reports.
  2. Click Ad Hoc Reports.
  3. Click View Report.

Editing an ad hoc report

Edit online

Procedure

  1. Click Reports.
  2. Click Ad Hoc Reports.
  3. Click View Report.
  4. Click Edit.
  5. Add or update the Executive Summary for the report.
  6. Remove any unneeded widgets from the report.
  7. Apply any detection strategy or alert filters that are needed to customize the report.
  8. Click Finish Editing.

Exporting an ad hoc report

Edit online

Procedure

  1. Click Reports.
  2. Click Ad Hoc Reports.
  3. Click View Report.
  4. Click Export.

Deleting an ad hoc report

Edit online

Procedure

  1. Click Reports.
  2. Click Ad Hoc Reports.
  3. Click a report in the reports list.
  4. Click Remove.