Custom Report Templates

Unlike regular report templates provided by the solution vendor, custom templates make it possible to generate reports tailored to user needs. The administrator can select the desired fields to display and set the criteria and possible groupings. The custom reports created in this way can be used in report rules along with the regular predefined reports. To create a custom report template, go to the Reports --> Custom report templates section, click Add, and provide these settings:

Name

Description

Name

The name of the custom report template.

Description

An optional description of the custom report template.

Category

Select the data source for the template. Available values:

  • Events

  • Traffic

  • Web access

  • IDPS

  • SSH inspection

  • Triggered alerts

  • Endpoint events

  • Endpoint rules

  • Endpoint applications

Filter query

An SQL-like query string that allows you to limit the amount of information used to generate a report based on this template. To construct a query, use field names and values, keywords, and operators. В качестве полей данных можно использовать столбцы, перечисленные ниже в поле Столбцы. Ключевые слова и операторы, а также примеры их использования можно посмотреть в разделе документации Поиск и фильтрация данных.

Sort by

Specify the data field to sort the data by. The sorting can be in the ascending or descending order.

Group by

Specify the data field to group the data by.

Columns

The list of columns available for the specific data source.

Selected

The list of columns selected for display in the report.