Managing reports

When managing the program web interface, users with the Senior security officer role can manage reports on program alerts: create report templates, create reports based on a template, view and delete reports and report templates.

Users with the Security auditor role can view reports and report templates and create reports from templates.

A report is generated based on a selection of alerts for a specified period. If you are using

distributed solution

Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

multitenancy mode

Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

You can manage report templates and reports in all operating modes of the program in accordance with the license.

Perform the report creation steps in the following order:

1. Create a report template.
2. Create a report based on the template.

Users with the Security officer role do not have access to reports.

Viewing the table of templates and reports

Templates and reports are displayed in the Reports section of the program web interface window.

The Generated Reports subsection contains a report table. The table contains the following information:

• Time created—Date and time of report creation.
• Report name—Name of the report created based on the template.
• Servers—Name of the server with the Central Node component on which the report was created (if you are using distributed solution and multitenancy mode).
• Period—Period for which the report was generated.
• Created by—Name of the user that created report.

The Templates subsection displays the table of templates. The table contains the following information:

• Time created—Date and time when the template was created.
• Time updated—Date and time of last modification of the template.
• Report name—Name of the template.
• Created by—Name of the user that created the template.

Creating a template

When creating a report template, you need to specify all the information that you want to display in the report: report name, its description, availability of a table, graph or image. You can also select the data that you want to display in the report and define the position of report elements.

When creating a report in the Reports section, Generated Reports subsection of the interface, you can only select the template for creating the report and the data display period.

A new report template is created for each data sample.

To create a template:

1. In the program web interface window, select the Reports section, Templates tab.

   This opens the table of templates.

2. Click Add.

   This opens the template creation window. This window contains the body of the report and the report builder in a floating window. You can move the report builder over the workspace of the web interface window.

3. In the Template name field in the upper-right corner of the window, type the name that you want to assign to reports that are created from this template. For example, Alerts by technology.

   This name is displayed in the table in the Reports section, Generated Reports subsection when creating all reports in this template.

4. In place of the Report title text, type the report name that will be displayed in a report after the report is created. If you do not want to add a report name, you can delete the Report title text and leave this report section blank.

   You can format text using the buttons in the Text section in the template designer.

5. In place of the Report description text, type the report description that will be displayed in a report after the report is created. If you do not want to add a report description, you can delete the Report description text and leave this report section blank.

   You can format text using the buttons in the Text section in the template designer.

6. Using the report builder, add one or more report elements:
   • Table.
   • Pie chart.
   • Image.
7. If you chose to add an image, the Image window opens. Do the following:
   1. Click Upload.
   2. Upload the image. For example, you can upload your company logo.
   3. In the list on the right of the upload button, select the alignment of the image on the report page: Left, Right or Center.
   4. Click Apply.
8. If you chose to add a pie chart, the Pie chart on alert attributes window opens. Do the following:
   1. In the Name field, type the name of the pie chart. For example, Top 5 alerts by technology. You can also leave the field blank.
   2. In the Data source list, select the alert property for which you want to create a pie chart. For example, Technologies.
   3. In the Number of slices field, specify the maximum number of sectors of the pie chart. When a report is created, the program selects the most frequently encountered data. For example, if you specified 5 sectors and want to create a pie chart by technology, the program will show a pie chart for the 5 technologies that generated the highest number of alerts. The technologies that generated the lowest number of alerts are not displayed on the pie chart.

      Click Apply.

9. If you chose to add a table, the Alerts table window opens. Do the following:
   1. In the Available columns field, double-click to select the alert properties that you want to add to the report table.

      The selected properties are moved to the Selected columns field. You can drag the names of columns between the Available columns and Selected columns fields, and change the order of columns in the report table.

      For example, if you moved the Technologies, Detected and Time created properties to the Selected columns field, the table of the created report will show the technologies that generated alerts, a list of detected objects, and the time when the alerts were generated.

   2. If you want to filter alerts by the State property, select the check boxes next to the processing statuses of alerts whose data you want to display in the report.
   3. If you want to filter alerts by the Technologies property, select the check boxes next to the names of program modules and components whose data you want to display in the report.
   4. If you want to filter alerts by the Importance property, select the check boxes next to the importance levels of alerts whose data you want to display in the report.
   5. If you want to filter alerts by the VIP status, select VIP in the list. Only alerts with the VIP status are displayed in the report.
   6. Click Apply.
10. Click the Save button in the upper-right corner of the window.

A new template will be created.

Users with the Security auditor and Security officer roles cannot create report templates.

Creating a report based on a template

To create a report based on a template:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. Click Add.

   This opens the New report window.

3. Do the following:
   1. In the Template drop-down list, select one of the templates for creating a report.
   2. In the Period settings group, select one of the following options:
      • Last hour, if you want the report to contain information about program operation during the last hour.
      • Last day, if you want the report to contain information about program operation during the last day.
      • Last 7 days, if you want the report to contain information about program operation during the last week.
      • Last 30 days, if you want the report to contain information about system operation during the last month.
      • Custom, if you want the report to contain information about system operation during the period you specify.
4. If you have selected the Custom display period for information about program operation:
   1. In the calendar that opens, specify the start and end dates of the period for which the report will be generated.
   2. Click Apply.
5. If you are using distributed solution and multitenancy mode, in the Servers settings group, select the check boxes next to the tenants and servers whose data you want to include in the report.
6. Click Create.

The created report is displayed in the table of reports. You can download the report for viewing on your computer.

Users with the Security officer role cannot create report templates.

Viewing a report

To view a report:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. Select the report that you want to view.

The report opens in a new tab in your browser.

Downloading a report to a local computer

To download a report to your computer:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. In the line containing the report that you want to view, click the icon.

   The report will be saved in HTML format to your local computer in the browser's downloads folder.

   To view a report, you can use any application designed for viewing HTML files (for example, a browser).

Editing a template

To edit a template:

1. In the program web interface window, select the Reports section, Templates tab.
2. This opens the table of templates. Select the template that you want to edit.

   This opens the template editing window.

3. You can edit the following settings:
   • Template name – report name that is displayed in the table in the Reports section, Generated Reports subsection when creating all reports based on this template.
   • Report title – report name that is displayed in a report after the report is created.

     You can format text using the buttons in the Text section in the template designer.

   • Report description – report description that is displayed in a report after the report is created.

     You can format text using the buttons in the Text section in the template designer.

   • Image. You can upload or delete an image.
   • Pie chart. You can change the following pie chart settings:
     • Name.
     • Data source.
     • Number of slices.

     Click Apply.

   • Table. You can change the following table settings:
     • Selected columns. You can drag the names of columns between the Available columns and Selected columns fields, and change the order of columns in the report table.
     • State.
     • Technologies.
     • Importance.
     • VIP status.
4. Select one of the following methods to save the template:
   • If you want to apply changes to the current template, click the Save button.

     The template will be changed.

   • If you want to create a new template, enter a name for the template and click Save as.

     The name of the new template must not be the same as the name of an already existing template.

     The new template will be saved.

Users with the Security auditor and Security officer roles cannot edit templates.

Filtering templates by name

To filter templates by name:

1. In the program web interface window, select the Reports section, Templates tab.
2. This opens the table of templates. Click the Report name link to open the template filtering menu.
3. In the drop-down list, select one of the following template filtering operators:
   • Contains
   • Does not contain
4. Enter one or several characters of the template name.
5. If you want to add a filtering criterion to the filter, click the button under the list of filtering operators and repeat the sequence for specifying filtering criteria.
6. Click Apply.

The table of templates will display only templates that match the filter criteria you have set.

Filtering templates based on the name of the user that created the template

To filter templates by the name of the user that created the template:

1. In the program web interface window, select the Reports section, Templates tab.
2. This opens the table of templates. Click the Created by link to open the menu for filtering templates.
3. In the drop-down list, select one of the following template filtering operators:
   • Contains
   • Does not contain
4. Enter one or several characters of the user name.
5. If you want to add a filtering criterion to the filter, click the button under the list of filtering operators and repeat the sequence for specifying filtering criteria.
6. Click Apply.

The table of templates will display only templates that match the filter criteria you have set.

Filtering templates by creation time

To filter report templates by creation time:

1. In the program web interface window, select the Reports section, Templates tab.
2. This opens the table of templates. Click the Time created link to open the menu for filtering templates.
3. Select one of the following template display periods:
   • All, if you want the program to display all created templates in the table.
   • Last hour, if you want the program to display the templates that were created during the last hour in the table.
   • Last day, if you want the program to display the templates that were created during the last day in the table.
   • Custom range, if you want the program to display templates that were created during the period you specify in the table.
4. If you have selected the Custom range template display period:
   1. In the calendar that opens, specify the start and end dates of the template display period.
   2. Click Apply.

The table of templates will display only templates that match the filter criteria you have set.

Clearing a template filter

To clear the template filter for one or more filtering criteria:

1. In the program web interface window, select the Reports section, Templates tab.
2. This opens the table of templates. Click to the right of the header of the column of the template table for which you want to clear the filter conditions.

   If you want to clear several filter conditions, perform the necessary actions to clear each filter condition.

The selected filters are cleared.

The table of templates will display only templates that match the filter criteria you have set.

Deleting a template

To delete a template:

1. In the program web interface window, select the Reports section, Templates tab.
2. This opens the table of templates. Select the check box in the line containing the template that you want to delete.
3. Click Delete.

   This opens the action confirmation window.

4. Click Yes.

The template that you selected will be deleted.

Users with the Security auditor and Security officer roles cannot delete templates.

Filtering reports by creation time

To filter reports by creation time:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. Click the Time created link to open the report filtering menu.
3. Select one of the following report display periods:
   • All, if you want the program to display all created reports in the table.
   • Last hour, if you want the program to display the reports that were created during the last hour in the table.
   • Last day, if you want the program to display the reports that were created during the last day in the table.
   • Custom range, if you want the program to display reports that were created during the period you specify in the table.
4. If you have selected the Custom range report display period:
   1. In the calendar that opens, specify the start and end dates of the report display period.
   2. Click Apply.

The table of reports will display only reports that match the filter criteria you have set.

Filtering reports by name

To filter reports by name:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. Click the Report name link to open the report filtering menu.
3. In the drop-down list, select one of the following report filtering operators:
   • Contains
   • Does not contain
4. In the entry field, specify one or several characters of the report name.
5. If you want to add a filtering criterion to the filter, click the button under the list of filtering operators and repeat the sequence for specifying filtering criteria.
6. Click Apply.

The table of reports will display only reports that match the filter criteria you have set.

Filtering reports by the name of the server with the Central Node component

To filter reports by the name of the server with the Central Node component:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. Click the Servers link to open the report filtering menu.
3. Select the check boxes opposite those servers by which you want to filter reports.
4. Click Apply.

The table of reports will display only reports that match the filter criteria you have set.

Filtering reports based on the name of the user that created the report

To filter reports by the name of the user that created the report:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. Click the Created by link to open the report filtering menu.
3. In the drop-down list, select one of the following report filtering operators:
   • Contains
   • Does not contain
4. Enter one or several characters of the user name.
5. If you want to add a filtering criterion to the filter, click the button under the list of filtering operators and repeat the sequence for specifying filtering criteria.

The table of reports will display only reports that match the filter criteria you have set.

Clearing a report filter

To clear the report filter for one or more filtering criteria:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. Click to the right of the header of the column of the reports table for which you want to clear the filter conditions.

   If you want to clear several filter conditions, perform the necessary actions to clear each filter condition.

The selected filters are cleared.

The table of reports will display only reports that match the filter criteria you have set.

Deleting a report

To delete a program operation report:

1. In the window of the program web interface, select the Reports section, Generated Reports subsection.

   This opens the table of reports.

2. Select the check box in the line containing the report that you want to delete.
3. Click Delete.

   This opens the action confirmation window.

4. Click Yes.

The selected report will be deleted.

Users with the Security auditor and Security officer roles cannot delete reports.