🌙
 

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Configure Custom Reports

reports queries advanced search query language builder


Reports in Secureworks® Taegis™ XDR can be generated from a search query. A report can be configured to run one time or at a scheduled recurrence. By default reports output to PDF format, with the option to include a CSV format as well.

Available Custom Report Types

The following report visualizations are available to download as a PDF file format.

Pie Chart

Pie charts are appropriate for comparing proportions of value.

Alerts Severity Pie Chart

Alerts Severity Pie Chart

Bar Chart

The bar chart is appropriate for observing a trend over time of a single series of data. It has a vertical orientation.

Alerts Bar Chart

Alerts Bar Chart

Stacked Bar Chart

The stacked bar chart is appropriate for observing a trend over time of multiple series of data. It has a vertical orientation.

Alerts Severity Stacked Bar Chart

Alerts Severity Stacked Bar Chart

Horizontal Bar Chart

The horizontal bar chart is appropriate for observing a part to whole trend of a single series of data.

Target User Name Horizontal Bar Chart

Target User Name Horizontal Bar Chart

Data Table Only

Choose this option to exclude any chart visualization and only include the resulting data table.

Alerts Severity Data Table Only

Alerts Severity Data Table Only

Set up the Report Query

The basis of all reports begins with a search query. Once a query has been formed and executed, the ability to generate a report becomes available.

Creating a report from a query

Creating a report from a query

To create a report:

  1. Select Advanced Search from the left navigation bar in Taegis™ XDR and choose the interface you prefer: Query Language or Builder.

  2. Craft a search query.

  3. Select Search to run the search.
  4. Review the resulting data table to ensure the expected results appear.
  5. At the top right of the results data table, select Create Report to begin the report creation workflow. The Report Configuration panel is displayed.

Note

Search currently only supports Events and Alerts schemas. (View supported schemas in the in-application sidebar help of Advanced Search.)

Note

Search for Events is restricted to a 31-day time period and a result set of no greater than 100,000 records. If more records are needed, it is recommended to refine the search query and perform multiple queries/reports.

Configure the Report

A report contains multiple properties that can be adjusted depending on what you’d like the report to present. These properties include:

Tip

There is a preview of the search query results in the left-hand side of the Report Configuration panel, for quick reference while configuring the report. You can page through the results using the left and right arrows.

After each step, select Next to proceed to the next configuration step.

Step 1: Visualization Settings

There are two visualization settings in this step: choosing the appropriate type of chart or graph to generate, and choosing the output file format.

Available Charts

Select the type of chart or graph needed to visualize the data. The available options are:

Note

If the search query performed is not compatible with a visualization, the option will be disabled.

Choosing a visualization for the report

Choosing a visualization for the report

Available Output File Formats

Reports are generated as PDF files by default. This file includes the metadata defined by the user during the configuration process, the selected visualization of the query results, and a data table containing the aggregated query results.

To generate a CSV and/or JSON file that contains the non-aggregated data from the search query with the PDF:

  1. Select a chart type.
  2. Select the Export data to CSV and/or JSON option below the chart types.

Tip

If you want a CSV and/or JSON file only and not a PDF, do not select any of the chart types; only select the CSV and/or JSON option.

Step 2: Configure Report Data

Depending on the type of report visualization you selected in step 1, you may have the option of configuring the data that will be included in your report.

Configuring a Stacked Bar Chart report

Configuring a Stacked Bar Chart report

Pie Chart

Select the category that should be used to group the segments of the pie.

Vertical Bar Chart

The bar chart is preconfigured with timestamp on the X-axis and total count (aka the aggregate value) on the Y-axis.

Stacked Vertical Bar Chart

The stacked bar chart is preconfigured with timestamp on the X-axis and total count (aka the aggregate value) on the Y-axis. Select the series (aka the category) that should be used to group the segments of the bars.

Horizontal Bar Chart

The horizontal bar chart is preconfigured with total count (aka the aggregate value) on the X-axis. Select the category that should be used on the Y-axis.

Data Table Only

Select the category to group the data by and sum the value of.

Step 3: Schedule Report

A report can be scheduled to run at a variety of intervals as defined below. One scheduling option may be defined per report.

Note

The time zone field specifies what time zone a scheduled report should run; it does not affect the timestamps used throughout the report data.

Scheduling a report

Scheduling a report

Step 4: Report Name and Sharing

In the last step of report configuration, define the following:

Note

You automatically receive any report that you create yourself; you do not need to add yourself to the user list.

Naming and sharing a report

Naming and sharing a report

Step 5: Complete the Report

After all configuration steps are completed, select Finish. The query results page is displayed, with a banner informing you that the report is being created. You will receive an email notification when it is ready to download.

 

On this page: