Reports and analysis

You can view and print statistical information by using the Analytics dashboard and incident information by using the reports features.

The Analytics dashboard, available from the Dashboard menu, presents statistical information in the form of tables and charts. You can use the provided predefined widgets or create your own tables and charts then save them in a customized dashboard.

The Reports feature provides detailed information about incidents. You can generate a report on one or more incidents from the Incidents page, or directly from a specific incident. You can use a predefined report template or create your own template to specify which data to include.

Reviewing the Analytics Dashboard

The Analytics Dashboard provides access to various charts and graphs for viewing statistical information, depending on your access and permission level.

To open the Analytics Dashboard, click Dashboards in the menu, and then select Analytics Dashboard. To display other dashboards, click the selector icon, , and choose from the list of dashboards that are available to you.

The following image shows an example of an analytics dashboard with two widgets, Dashboard Header and Incidents Over Time By Type.

In each table and chart, you can click the various elements to learn more information about each data point. To display or remove an item from a chart, click the item in the chart legend.

To view the chart data in different ways, click the menu. To improve the readability, you can view the chart in full screen mode, or you can select Toggle Data Table to view the chart data. You can also download, export, and print the chart.

New in 51.0.1.0 Configuring week start day

An administrator can configure the week start day for the Incidents Over Time by Type, New And Open Incidents, and Custom widgets when the time period is week. To configure the week start day, use the analysis_start_day_of_week configuration variable. If you do not set the analysis_start_day_of_week configuration variable, there is no change to the existing functionality.

Note the following points about configuring the week start day:

Incidents after the period start day are included as the same group.
The analysis_start_day_of_week determines the Bucket label.
If analysis_start_day_of_week is set to 1, the start of week is Monday and this is reflected in the date labels. Incidents created after Monday are included.
If analysis_start_day_of_week is set to 0, the start of week is Sunday and this is reflected in the date labels. Incidents created after Sunday are included.

To configure the week start day, use resutil to set the analysis_start_day_of_week configuration variable, similar to the following, where the start day is set to Sunday by specifying 0:

sudo resutil configset -key analysis_start_day_of_week -ivalue 0 //set start day to Sunday

To revert to the original configuration:

sudo resutil configset --delete -key analysis_start_day_of_week

Customizing the Analytics Dashboard

The Analytics Dashboard provides a selection of predefined widgets, such as pivot tables and charts, which you can place on the dashboard.

The following table shows the ways that you can customize the Analytics Dashboard.

Table 1. Analytics Dashboard customizations
Customization	Description
Add a widget.	Click Add Widget and click the type of widget that you want to add. Drag the widget to the preferred location on the dashboard. The number of times that each type of widget is used on the dashboard is shown next to the widget name.
Configure an existing widget.	Hover over the widget and select the wrench icon to open the widgets configuration dialog. Select the configuration options, such as the date range, that you want to implement. Click Save. Widgets that you cannot customize do not have the wrench icon.
Remove a widget.	Hover over the widget and select the X icon.
Filter information.	Filters that are applied appear beneath the dashboard name. To add more filters, click More and select the filter from the list. For example, to filter by workspace, select the Workspace filter and select the workspaces that you want to view. Filters that are applied to a specific widget work with filters that are enabled for the entire dashboard. For example, on the Analytics Dashboard, enable the Incident Disposition, Severity, and Status filters. Then, on the Incident List widget, enable the Incident Disposition and Severity filters. Only values from the Incident Disposition and Severity filters are displayed on the Incident List widget. Some widgets, such as the Notifications widget, do not have filters.
Save changes as a new dashboard.	To save your changes, create a new analytics dashboard. On the dashboard, click Save As and enter a name and a brief description. If you have permission, you can set the dashboard to be Shared with all users. To discard dashboard changes, click the arrow next to Save Changes and click Discard Changes.
Change the dashboard name, or share it with other users.	To change dashboard information, such as name, description, and sharing permissions, click the selector icon () and choose Manage Dashboards. Tip: When the dashboard is set to Shared, you can share a dashboard with another user by sending them the URL link. You must have permissions to change the dashboard settings. To view the contact information for the dashboard owner, hover over the owner’s name.
Add headers, images, or text.	Use HTML code and CSS styling to add headers, images, or text to the dashboard. Click Add Widget in the dashboard. Select the Custom HTML Block widget. In the Custom HTML Block Widget window, type a title for the widget. Select a size for the widget. Use Full size for large areas that span across the screen, while Half is useful for displaying a smaller area. Enter the HTML content. Click Save. For example, the following HTML code adds an image with custom styling. `<img style='width:400px; height:400px;' src='https://your.company.com/path/image.jpg' />`

Generating an incident report

You can generate a report on a single incident or on multiple incidents. You can use a standard template to format the report, or you can customize it to meet your needs.

Choose from one of the following methods to generate an incident report.

Table 2. Methods of generating an incident report
Scope of information	Method
Single incident report	On the incident page, the following report generation options are available. Download Incident History Report Use this option to generate an incident report (.xls) that shows the history of the incident. The report shows the user who created or changed the incident, the date it occurred, a list of fields in the incident, and the old and new values for each of the fields. Generate Incident Report Use this option if you want to generate a report that is based on an existing template, or if you want to create your own template. Tip: You can also use this option to see which sections are included in a pre-defined report. Choose the report template to view and then click Customize template to open the Build a Report page. Review the check boxes for each section that appears on the report. Click Back to Incidents List to exit without saving.
Multiple incident report	In the incident list, select one or more incidents, and then click Export. Choose from the following options. Export all Exports all incidents to an Excel file. Choose whether to export only the visible columns, or all columns, and click Export. The system generates the report and prompts you to download the file. Export selected Exports only the selected incidents to an Excel file. Choose whether to export only the visible columns, or all columns, and click Export. The system generates the report and prompts you to download the file. Generate report. Use this option if you want to generate a report that is based on an existing template, or click Customize template to create your own. Tip: You can also use this option to see which sections are included in a pre-defined report. Choose the report template to view and then click Customize template to open the Build a Report page. Review the check boxes for each section that appears on the report. Click Back to Incidents List to exit without saving. With Export all and Export selected selections, if the report takes time to generate, an Export in progress window provides the option to receive an email when the report is ready. You can also access the report in the Activity Dashboard.

The following types of reports are available.

Table 3. Types of reports
Report type	Description
System Reports	Pre-defined templates that are included with the SOAR Platform. You can select a system report and use it as the basis for creating your own template, but you cannot modify or delete the pre-defined template.
Shared Reports	Reports that are created and shared by another user. You can select a shared report and use it as the basis for creating your own template. You can also edit or delete the shared report template.
Your Reports	Reports that are created and saved by you. You can customize one of your own reports, and then click Save As to create a new report template. You can also edit or delete your own reports.

Creating or editing a report template

Depending on the type of report that you generate, you might be prompted with the option to choose a report template. You can use an existing template as the basis for customizing your own report.

To create or edit a report template:

When prompted, choose an existing report from the report list.
Click Customize template to open the Build a Report page.
Click the menu next to the report template name to select a template.
In the System Sections panel, click the checkbox for each of the sections that you want to appear in the report. Deselect sections that you want to omit.
Some sections have extra options. For example, the Task Details section includes two extra options. The Notes checkbox includes the task notes with each task in the report and is enabled by default. The Incident Fields checkbox includes task layouts and data tables in the report, and is not enabled by default.

Tip: If you select the Incident Fields checkbox in Task Details, you can change the width of the columns in a data table. However, making the columns too wide can cause them to be pushed off screen and not printed in the report.
To reorder a section in the report, drag each section within the preview on the right side of the screen.
If you are modifying an existing template, click the menu next to Save As, and select Edit.
You can modify the template name, description, and whether the report is private or shared. When done, click Save.

Tip: When the report template is set to Shared, you can share the template with another user by sending them the URL link.
To create a new template based on your selections, click Save As and provide the information for the new template.
When done, click Print to generate the report.
After the report is generated, you can choose to print it.

When you create or edit a report template, the filters or settings in the following sections are saved when the template is saved: Attachments, Tasks Details, Task List, and Timeline, including the zoom setting in the Timeline section.

The following video shows how to customize the report template.