Instance report

Instance report is a PDF report that provides critical metrics for Hosts, Policies, and Alerts for the instance. Instance reports can be generated on demand or scheduled for weekly or monthly email delivery. Weekly reports contain data for the last week and monthly reports for the last month. Instance reports can also be delivered through emails to up to three recipients per report.

Data in the report

Data in the report is limited to a week or a month, depending on the schedule for the report. Currently, the report has a title page and 4 pages of data.

• Total number of hosts, number of hosts by the Connectivity status, Agent update status, and Type of Xprotect agent (Server or User), Top 10 hosts that generated the most number of alerts, and Top 10 hosts on which the most number of processes were blocked or killed. 

• Top 5 processes that generated alerts for Whitelist rules, Top 5 processes that generated alerts for Blacklist rules, Top 5 processes that generated alerts for Rule Rings rules, Most frequent alerts, and alerts generated on most Hosts.

• Total number of alerts, number of alerts that led to blocking processes as per Whitelist, Blacklist, and Rule Rings rules, and the statistics for High threats, Blocked processes, Killed processes, Unknown applications discovered, and most number of alerts generated and the relevant policy. 

• Linux, macOS, and Windows policy assigned to top 10 Host groups with the most number of hosts.

Schedule Instance reports

As soon as you create a Scheduled Instance report, a reporting job is run to schedule the first report. The first Instance report for the schedule is available for download from the Scheduled Reports page and the email recipients for the report receive the report.  

1. Go to Reports.

2. Click Create New Report.

3. Select Instance Report.

4. Select the report schedule - Scheduled Weekly or Scheduled Monthly.

5. In the Add Email area, add up to three email addresses.

6. Click Create.

Scheduled Instance reports

Scheduled Instance reports are the different weekly and monthly schedules of the Instance reports created for the instance .

• In the Scheduled Reports tab, see the Report Schedule, Last Sent On, and Scheduled Next For columns of the Scheduled Instance reports for the specifics of the schedule.

Download Instance reports

You can download On-demand and Scheduled Instance reports to your local computer.

• Scheduled Reports tab - click the Download icon (in the Report Name column) for a report, to download the report sent (emailed) for the latest schedule of the Instance report.
  

• Reports History tab - all On-demand Instance reports and the completed schedules of all the Scheduled Instance reports are listed here.
  

  • For an On-demand report, click the Download icon.

  • For a Scheduled report, see the Sent On column to identify the schedule and click the Download icon.
    

On-demand Instance report

• To generate an On-demand Instance report, select On Demand Report instead of selecting the schedules, and select a Date Range.

Add or remove email recipients

You can add or remove email recipients for a Scheduled report.

1. In the Scheduled Report tab, click the 3-dot menu of a report, and click Edit Report. 

2. In the fly panel, add or remove recipients and click Save.