I'd like to chat with you about managing reports,
including how to schedule reports to happen automatically,
based on when you want them to happen,
and how we can modify the caching for reports.
In the event we want to use that feature,
so they run faster,
and also how we can export a report and import it,
because if we have four or five different administrative
domains, the settings for the reports are unique
to each of those administrative domains.
So if you create a custom report or some other element
and you want to move it to a different administrative
domain, we need to export it from the domain it's in, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
domain, we need to export it from the domain it's in,
and then import it back to the domain we want it to be in.
So let's head back to the 40 Analyzer,
and I'd love to walk you through several of the options
regarding working with and managing reports.
All right, so back at the 40 Analyzer,
we'll go on the left-hand side down to reports,
and to report definitions.
And let's go to one of our pre-built reports.
In fact, let's go down to the SOC reports,
and let's go to the 360 security review,
and let's go and right-click on that,
we'll clone it, and we'll call it our 360 security review, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'll clone it, and we'll call it our 360 security review,
and we'll click on OK.
So here, for the settings, we can specify details.
For example, the time period we want this to look at,
which devices are included, and if we want to schedule it,
here's how we do it.
We're looking at the actual report itself,
not the templates or any else that went into the reports,
but they report itself.
So if we want to schedule this right here in the details
for editing our 360 degree security review,
we'd click right here on Enable Schedule.
So here we can specify the details for how often we want
the report to generate, and we do it for us automatically.
So if I said, for example, the start time, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if I said, for example, the start time,
it is the 11th today.
And then she's determined the future,
and I'll say 13, 15, and 0 seconds.
And based on the current clock,
that'll be in about a few minutes.
Fantastic.
And I'll specify the end time as tomorrow,
and that way it'll run every hour.
So at 1.15, it's going to begin creating reports,
it'll do it every hour.
And then once we reach 8.12, which is tomorrow's date,
it'll stop.
Also, once I scheduled it, it automatically enabled auto
caching.
And what auto caching does, it collects and builds effectively
the queries and the data for that report, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the queries and the data for that report,
and it does it in the background as that information comes in.
So when we run the report, it runs much faster.
So by default, anytime we schedule a report,
it automatically enables auto cache for us.
But if you don't want it, you can turn off,
however, auto cache does make it run a little bit faster.
We could also enable notifications,
assuming you also set up profiles for the notifications,
which is under advanced settings.
And that way, the correct people
can be notified once those reports are run.
I haven't set up notifications yet,
so I'm going to disable that.
And then we could add filters to control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we could add filters to control
what information is included in our report.
So if you want to add filters, you can click on the plus symbol,
put in the parameters.
And then you could say log messages that match all these
or any of the following.
So you're controlling what's actually
being put into the report.
And then we also have advanced settings.
We scroll down here.
We have options like the print orientation, and the layout,
and so forth under the advanced settings.
So I'm going to take the defaults for filters and advanced settings
and click on apply.
Or in fact, because we created this ourselves,
we could also go to the editor and tweak it here.
So here I'll put our tweaks added and then click on apply. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here I'll put our tweaks added and then click on apply.
So if we click on return, and I'll go ahead and do a search for hour,
and there's hour 360 security review, I'll go ahead and right click on that.
And let's go ahead and run it.
So let's generate a report.
So we could double click here, and it would show us all the reports
that were run regarding that.
Or we could go to generate reports, and this will show us all of our reports.
So here I have two reports.
So I've got this one, and this one.
One of them was because we manually ran the report.
And the other was because I had scheduled it every hour. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the other was because I had scheduled it every hour.
And here in a moment, they will both be ready.
And there it is.
So here's that report right here.
If we click on HTML, it'll open up a new tab, and there is our report.
So if we go back to our report definitions,
so there's only customized right there, we double click on it.
Here, showing us that it was run twice.
So one of them was because we manually ran it,
and the other one was because we told it to run every hour.
So effectively, they should both have the same information in them.
So if we click on HTML, here are the details.
And let's see if we have any incidents as well.
So we've got an instance.
Sure enough, we have this incident right here.
So let's imagine that report was relevant to this incident. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's imagine that report was relevant to this incident.
We could right click here.
And let's take a look and see if we have an instance.
Sure enough, we have an instance.
So if we go back to that report and then we generate reports,
we could right click on one of these and add that to an existing incident.
So it would be nice and easily available as part of that incident report.
So we'll click add to existing incident.
We only have one, there it is, I'll select it, click on OK,
and now it's part of that incident.
Or if we had a report that was run and after looking at it,
we wanted to create an incident, we could right click on a report,
and then create a new incident from here, put in the details, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then create a new incident from here, put in the details,
and that report would be associated with it as well.
So I'll cancel that, we don't need a second incident.
And as far as notifications when reports are generated,
let's take a look at advanced settings and the reports.
So here is a calendar showing our report starting to be generated.
We figured an output profile, currently I don't have one,
if we click on Create New.
So here on the output profile, if we wanted to,
we could have those reports emailed to the respective parties that need to
receive them.
Now if they're super sensitive, we might want to be sure we're not saying these
emails
with these reports to email addresses outside the company. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with these reports to email addresses outside the company.
So we'd want to be very careful about who we're saying these reports to.
And as far as email servers, we'd set that up under system settings, advanced,
and then go to mail server, and then we put in the details for our email server
that could be used to forward out those email messages with the reports.
Now another interesting note is this,
let's imagine we're working with a report, and it's going to report definitions
,
and let's go down to our SOC reports, and let's go and grab this one right here
,
our 360 degree security review.
This one because it was cloned and created and edited here in this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This one because it was cloned and created and edited here in this
administrative domain,
which is the root ADOM, it doesn't exist in the other ADOM.
So if we wanted to bring it over there, we could export it here,
and then import it on the other side.
As an example of that, we could right click from the dropdown,
we could go ahead and click on export.
By default, these dependent settings like subnets,
LDAP server output profile and email are not included,
but if we wanted to include them, we could.
Currently, I don't have the setup, so it won't matter too much,
so I'm going to disable them, and then we click on OK.
We've just exported that.
Now on my computer, it's asking me to go ahead
and choose the location where I'm going to store that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and choose the location where I'm going to store that.
So I'm going to put in my downloads folder, I'll save that.
And then what we could do is we could go to the other ADOM, for example,
we'll go to our BR1-ADOM.
And then with the all reports tab selected here,
in this BR1-ADOM, we can go to more, and then click on import.
I then go ahead and drag and drop that file
that it conveniently put in my downloads folder,
because that's where I told it, so I'll drag it over here, click on OK,
and that will import it into this ADOM.
So now if we scroll down, there's our 360 degree security review right there.
So if we run this report, I'll go ahead and say run report. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we run this report, I'll go ahead and say run report.
Then we double click here, it'll show us the reports matching that,
or we could get it to generate reports,
and it should show up here in just a moment.
And there it is, and in a moment it'll be done.
And I'm not sure how much data we have
that's been logged to the ADOM called BR1-ADOM,
but we're about to find out.
So I'll click here on HTML, and yeah, we had some traffic for this calendar
year.
And that other ADOM, I think, had the branch office over there for maybe an
hour or two.
So this is showing us the application visibility and control information, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is showing us the application visibility and control information,
and we scroll down, here's the application categories,
and web application, fantastic.
Also, another interesting aspect regarding these reports that are being
generated,
if it's taking a lot of energy, a lot of CPU resources to crank these out,
we can also take a look at the diagnostics.
From the 4D Analyzer perspective, regarding a report that was generated.
So back at the 4D Analyzer, under reports and generated reports, if we right
click here,
one of the options is to retrieve diagnostic.
So if we click on retrieve diagnostic, it's going to ask us to save this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we click on retrieve diagnostic, it's going to ask us to save this
locally on our computer.
So I'll go ahead and save it locally, my downloads folder.
Then I'm going to open it up, and here's the content of that log file.
So there's a report name, there's when it was generated,
here's the administrative domain, there's the date range it covered,
here's the number of charts that were involved, and there's 32 of them.
So we'll scroll down through that list, and it was including all the devices,
and AutoCached was enabled for that report.
And as we continue to scroll down, we have the quota summary and storage
summary,
and this would be for that specific administrative domain it came from. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and this would be for that specific administrative domain it came from.
And here's the version of the 4D Analyzer, it's serial number,
and system performance information when that report was run.
So in the event we have a report that takes a ton of CPU or has another issue
with it,
the diagnostics is a great tool to help dig down into what's happening.
Think of it like a black box recorder for an airplane with all the nitty-gritty
details,
regarding that date and time and that moment when that report was generated.
Now because the original report had caching enabled in the previous ADOM,
we did the export and import to go back here,
and here's our 360-degree security review, we'll double click on it, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and here's our 360-degree security review, we'll double click on it,
and we'll click on settings, sure enough the AutoCached is still enabled.
And once again, that's because the caching was enabled on the original report
when we did the export, so the caching is enabled here as well.
Also notice that the schedule is also intact here in this new ADOM based on the
import.
So to clean this up because I don't want that to run every hour,
I'm going to go ahead and not schedule it.
I'm going to leave the AutoCached enabled to click on Apply,
and do the same thing over in the root ADOM.
By going to the root ADOM by clicking here, going to the root ADOM, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
By going to the root ADOM by clicking here, going to the root ADOM,
and going into report and report definitions, and under SOCK reports,
because that's where we cloned it before we started working with it,
there's our 360-degree security review right there, we'll right click, click on
edit,
and then here under settings we'll specify we don't want to schedule it every
hour,
click Apply, and that way it won't run every hour.
And again, if we want to see the generated reports all together,
we can specify that by clicking on generated reports,
and then specifying how far back we want to look.
So if we want to look for example, the last seven days, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we want to look for example, the last seven days,
all these reports, it looks like they were all run today,
so they're all still showing up.
But if you had like hundreds of reports,
you could sort based on how far back you want to go.