Scheduled reports

You can schedule a report to show the following information:
  • All Events
  • Threat Events
  • Access Control Events
  • Alerts only
  • DNS Summary Report data
  • Proxy Summary Report data

A scheduled report that’s configured to show all alerts contains event information based on the threat categories or lists that are enabled with the Send Alerts setting in a policy. The Send Alert setting sends alert notifications to users who are configured to receive them. A scheduled report with only alerts shows the events that triggered these alerts.

If an administrator configures a report to show All Events, report recipients receive information about all events, regardless of whether a policy is enabled with the Send Alert setting.

In addition to showing all event and alert data, an administrator can configure a report to show only threat events, access control events, DNS summary report data, or proxy summary data. Generated report data for alerts and events are emailed to report recipients and presented in the body of the email. When you schedule a report with DNS summary or proxy summary data, the report recipient is emailed a PDF report that contains bar graphs. The bar graphs show the top activity based on report dimensions such as location, geographical region, domains, and more. This is the same data that an administrator can see in the DNS or proxy summary reports.

When creating a report, an ETP administrator can specify these settings:
  • Schedule a report to run on a daily or weekly basis.
  • Select the format of the report output. Report results are sent to the provided email addresses in HTML or plain text format. You enter the email addresses of ETP administrators or users who you want to receive report results.
  • Configure a scheduled report to show events for a specific location, sub-location, or multiple locations or sub-locations. By default, scheduled reports show data based on all locations. If you are a delegated or tenant administrator, you can select the locations that you are allowed to access.

Scheduled reports appear as a list on the Scheduled Reports page. With this view, you can easily review the settings associated with each report and if necessary, modify them.

Like alert notifications, an event report that is sent to administrators or ETP users is organized around domains and includes information about the event or alert such as the associated location, policy, and list. The report also includes alert or event details such as the action taken on the event. The report can show up to 5,000 events.

For more information on the data that is shown in report results, see Data in alert notifications and scheduled reports.