Managing reports

Reports are a core capability that you use to evaluate the current security posture of your infrastructure. QRadar® EDR provides you with an editable report that contains information about the latest developments.

About this task

Important: There is a known issue that can cause QRadar EDR to continuously send reports to the recipient who no longer has an instance of QRadar EDR. For more information, see Technote 7058243.

Creating scheduled reports

You can create a scheduled report to generate automatic reports at a specific time and frequency.

Procedure

  1. Click Reports.
  2. Click Create Scheduled Report.
  3. In the Create Scheduled Report page, enter a Name and Description for your report.
  4. If you're in an MSSP environment, select the target clients or groups for your report.

    If you select a client, all groups within the client are included in the report.

  5. Set the schedule for the report.
    The report is generated on the days that you selected at 00:00 in the specified time zone.
  6. If you want to add a logo to your report, click Report logo and add an image.
    Tip: The image must be a .jpg, .png, or .svg file, and no larger than 2 Mb. The suggested size of the image is 400® x 300 px.
  7. If you want to automatically send an email message with the report to other people, click Automatically send to.
    1. Enter the email addresses of the recipients in the Enter your emails here field.
      The email message is sent with these email addresses in the BCC field so that they addresses are not exposed to other recipients.
    2. Enter your email message in the text box.
  8. If you want to be notified when the report is ready, select Notify me when a new report is ready.
  9. Click Create.

What to do next

After the scheduled report is created, you can take the following actions:
  1. To pause a scheduled report, set the Active toggle for a report to the off position.
  2. To view a scheduled report, click View.
  3. To edit a scheduled report, click View > Edit.
    1. You can add or update the Executive Summary, remove any unneeded widgets, or apply any detection strategy or alert filters to customize the report.
    2. To save your updates, click Finish Editing.
  4. To export a scheduled report, click View > Export.
  5. To delete a scheduled report, click Remove.

Creating ad hoc reports

You can create an ad hoc report to generate one-time reports at any time.

Procedure

  1. Click Reports.
  2. Click Ad Hoc Reports.
  3. Click Create Ad Hoc Report.
  4. Enter a Name and Description for your report.
  5. If you're in an MSSP environment, select the target clients or groups for your report.

    If you select a client, all groups within the client are included in the report.

  6. Set the Starting date and Timezone for the report.
  7. If you want to add a logo to your report, click Report logo and add an image.
    Tip: The image must be a .jpg, .png, or .svg file, and no larger than 2 Mb. The suggested size of the image is 400 x 300 px.
  8. Click Create.

What to do next

After the ad hoc report is created, you can take the following actions:
  1. To view an ad hoc report, click View Report.
  2. To edit an ad hoc report, click View Report > Edit.
    1. You can add or update the Executive Summary, remove any unneeded widgets, or apply any detection strategy or alert filters to customize the report.
    2. To save your updates, click Finish Editing.
  3. To export an ad hoc report, click View Report > Export.
  4. To delete an ad hoc report, click Remove.