Scheduled reports

You can schedule a report and show alert information or information for all events that occurred within a specified time frame. An ETP administrator can schedule a report to run on a daily or weekly basis.

A scheduled report that’s configured to show alerts contains event information based on the threat categories or custom lists that are enabled with the Send Alerts setting in a policy. The Send Alert setting sends alert notifications to users who are configured to receive them. A scheduled report with only alerts shows the events that triggered these alerts.

If an administrator configures a report to show All Events, report recipients receive information about all events, regardless of whether a policy is enabled with the Send Alert setting.

When creating a report, an ETP administrator can specify these settings:
  • Schedule a report to run on a daily or weekly basis.
  • Select the format of the report output. Report results are sent to the provided email addresses in HTML or plain text format. You enter the email addresses of ETP administrators or users who you want to receive report results.
  • Configure a scheduled report to show events for a specific location or multiple locations. By default, scheduled reports show data based on all locations. If you are a delegated or tenant administrator, you can select the locations that you are allowed to access.

Scheduled reports appear as a list on the Scheduled Reports page. With this view, you can easily review the settings associated with each report and if necessary, modify them.

Like alert notifications, the report that is sent to administrators or ETP users is organized around domains and includes information about the event or alert such as the associated location, policy, and list. The report also includes alert or event details such as the action taken on the event. The report can show up to 2500 domains.

For more information on the data that is shown in report results, see Data in alert notifications and scheduled reports.