--- title: "Creating a Report | ThreatConnect" slug: "creating-a-report" description: "This article describes the different ways you can create a report in ThreatConnect." tags: ["Analytical Tools"] updated: 2025-02-03T22:51:24Z published: 2025-02-03T22:51:24Z canonical: "knowledge.threatconnect.com/creating-a-report" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Creating a Report ## Overview While viewing a Group or Case in ThreatConnect®, or when you are on the [**Reporting**screen](https://knowledge.threatconnect.com/docs/viewing-and-managing-all-saved-reports-and-templates) [](https://knowledge.threatconnect.com/docs/viewing-and-managing-all-saved-reports-and-templates)**[](https://knowledge.threatconnect.com/docs/viewing-and-managing-all-saved-reports-and-templates)**, you can click **+ Create Custom Report**and select whether to create a blank report or a report based on a saved [report template](https://knowledge.threatconnect.com/docs/report-templates). After you create a report, you can [add content to the report](https://knowledge.threatconnect.com/docs/adding-content-to-a-report), [organize the report](https://knowledge.threatconnect.com/docs/organizing-editing-previewing-and-deleting-a-report), and [save, publish, and export the report](https://knowledge.threatconnect.com/docs/saving-publishing-and-exporting-a-report). ## Before You Start ### User Roles - To create generic reports or reports for Groups, your user account must have an [Organization role](https://knowledge.threatconnect.com/docs/organization-roles) of Standard User, Sharing User, Organization Administrator, or App Developer. - To create reports for Cases, your user account must have an Organization role of Standard User, Sharing User, or Organization Administrator. ### Prerequisites - To be able to create reports for Cases, turn on Workflow for your Organization on the **Account Settings**screen (must be an Accounts Administrator, Operations Administrator, or System Administrator to perform this action). ## Creating a Report Without Using a Report Template The following subsections describe how to create a report that is not based on a saved report template (i.e., from scratch). NoteIn addition to the steps outlined in the following subsections, you can create a report for a Group or Case that is a search result on the [**Search**screen](https://knowledge.threatconnect.com/docs/viewing-search-results) with the **Create Custom Report**option in the result’s [⋯ menu](https://knowledge.threatconnect.com/docs/viewing-search-results#managing-search-results). ### Creating a Group Report Follow these steps to create a report for a Group that is not based on a saved Group report template: 1. Navigate to the [**Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen#viewing-the-details-screen) or **[](https://knowledge.threatconnect.com/docs/the-details-drawer)** [](https://knowledge.threatconnect.com/docs/the-details-drawer)[**Details**drawer](https://knowledge.threatconnect.com/docs/the-details-drawer) [](https://knowledge.threatconnect.com/docs/the-details-drawer)**[](https://knowledge.threatconnect.com/docs/the-details-drawer)** for a Group. 2. Click **+ Create Custom Report**in the **Details**screen or drawer header and select **Create New**. The **Report Editor**will open and display a new report, as well as the **Add Group Data**menu of the **Add Section**drawer (Figure 1). NoteIf viewing the [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy#viewing-the-legacy-details-screen) for a Group, click **Create Report**in the screen’s header to create a report for the Group. ![Figure 1_Creating a Report_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Creating%20a%20Report_7.5.0.png) 3. Select one or more **[Group Data](https://knowledge.threatconnect.com/docs/adding-group-data-to-a-report)**sections to add to the report. NoteBy default, the Group you created the report for will be selected in the **Group**dropdown on the **Add Group Data**menu. To add a different Group’s data to the report, click the **Group**dropdown, select **View All Groups…**, and select a Group on the **Select a Group**window. 4. (Optional) To return to the main menu of the **Add Section** drawer and add **[Basic Elements](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report)**and **[Layout Elements](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report)**sections to the report, click **< Add Group Data**at the top left of the drawer. 5. (Optional) [Organize the report’s contents and layout](https://knowledge.threatconnect.com/docs/organizing-editing-previewing-and-deleting-a-report#organizing-a-report). 6. [Save, publish, or export the report](https://knowledge.threatconnect.com/docs/saving-publishing-and-exporting-a-report). ### Creating a Case Report Follow these steps to create a report for a Case that is not based on a saved Case report template: 1. Click **Workflow** on the top navigation bar. Alternatively, hover over **Workflow**on the top navigation bar and select **Cases**. 2. Select a Case on the **[](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases)** [](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases)[**Cases**screen](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases) [](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases)**[](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases)** to [view the Case's details](https://knowledge.threatconnect.com/docs/parts-of-a-case#viewing-a-case). 3. Click **+ Create Custom Report**at the top right of the Case and select **Create New**. The **Report Editor**will open and display a new report, as well as the **Add Case Data**menu of the **Add Section**drawer (Figure 2). NoteYou can also access the **+ Create Custom Report**button on a [Case’s **Details**drawer](https://knowledge.threatconnect.com/docs/the-details-drawer-for-workflow-cases) while the drawer is open on the **[](https://knowledge.threatconnect.com/docs/viewing-search-results)** [](https://knowledge.threatconnect.com/docs/viewing-search-results)[**Search** screen](https://knowledge.threatconnect.com/docs/viewing-search-results) [](https://knowledge.threatconnect.com/docs/viewing-search-results)**[](https://knowledge.threatconnect.com/docs/viewing-search-results)**. ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Creating%20a%20Report_7.5.0.png) 4. Select one or more **[Case Data](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report)**sections to add to the report. NoteBy default, the Case you created the report for will be selected in the **Case**dropdown on the **Add Case Data**menu. To add a different Case’s data to the report, click the **Case**dropdown, select **View All Cases…**, and select a Case on the **Select a Case**window. 5. (Optional) To return to the main menu of the **Add Section** drawer and add **[Basic Elements](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report)**and **[Layout Elements](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report)**sections to the report, click **< Add Case Data**at the top left of the drawer. 6. (Optional) [Organize the report’s contents and layout](https://knowledge.threatconnect.com/docs/organizing-editing-previewing-and-deleting-a-report#organizing-a-report). 7. [Save, publish, or export the report](https://knowledge.threatconnect.com/docs/saving-publishing-and-exporting-a-report). ### Creating a Generic Report Follow these steps to create a generic report (i.e., a report that is not for a specific Group or Case) that is not based on a saved generic report template: 1. Click **Reporting** on the top navigation bar. 2. Click **+ Create Custom Report**at the top right of the **[](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports)** [](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports)[**Reporting**screen](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports) [](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports)**[](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports)** and select **Create New**. The **Report Editor**will open and display a new report, as well as the **Add Section**drawer (Figure 3). ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Creating%20a%20Report_7.8.0.png) 3. Select **[Intelligence Data](https://knowledge.threatconnect.com/docs/adding-intelligence-data-to-a-report)**, **[Basic Elements](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report)**, and **[Layout Elements](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report)**sections to add to the report. 4. (Optional) [Organize the report’s contents and layout](https://knowledge.threatconnect.com/docs/organizing-editing-previewing-and-deleting-a-report#organizing-a-report). 5. [Save, publish, or export the report](https://knowledge.threatconnect.com/docs/saving-publishing-and-exporting-a-report). ## Creating a Report From a Report Template The following subsections describe how to create a report from a saved [report template](https://knowledge.threatconnect.com/docs/report-templates). Using a report template ensures that your report is consistent with other reports your team has created and reduces time spent creating the report from scratch. NoteIn addition to the steps outlined in the following subsections, you can create a report for a Group or Case that is a search result on the [**Search**screen](https://knowledge.threatconnect.com/docs/viewing-search-results) with the **Create Custom Report**option in the result’s [⋯ menu](https://knowledge.threatconnect.com/docs/viewing-search-results#managing-search-results). ### Creating a Report From a Group Report Template Follow these steps to create a report for a Group from a saved Group report template: 1. Navigate to the [**Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen#viewing-the-details-screen) or **[](https://knowledge.threatconnect.com/docs/the-details-drawer)** [](https://knowledge.threatconnect.com/docs/the-details-drawer)[**Details**drawer](https://knowledge.threatconnect.com/docs/the-details-drawer) [](https://knowledge.threatconnect.com/docs/the-details-drawer)**[](https://knowledge.threatconnect.com/docs/the-details-drawer)** for a Group. 2. Click **+ Create Custom Report** in the **Details**screen or drawer header and select **Create From Group Template…**. NoteYou cannot create a report for a Group from a saved Group report template when creating a report on the [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy). 3. Select a saved Group report template on the **Create From Group Report Template**window, and then click **Create Custom Report**. The **Report Editor**will open and display a new report based on the selected Group report template (Figure 4). ![Figure 4_Creating a Report_7.6.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Creating%20a%20Report_7.8.0.png) NoteIf there are one or more sections in the report that are not populated with data, a message stating “One or more sections are empty.” will be displayed at the top of the **Report Editor**. To remove the empty sections, click **Remove Empty Sections**in this message, or click **Remove**in the **Report Editor**toolbar and select **Empty Sections**. 4. Review the report to identify placeholder sections that need to be configured manually. Hover over each placeholder section, click **Edit Content![Edit Content icon_Reports](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20Content%20icon_Reports.png)**,****and provide the required information. Alternatively, click **Remove Placeholders**in the **Report Editor**toolbar to remove all placeholder sections in the report. 5. (Optional) Click **+ Add Section**in the **Report Editor**toolbar to add additional **[Group Data](https://knowledge.threatconnect.com/docs/adding-group-data-to-a-report)**, **[Basic Elements](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report)**, and **[Layout Elements](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report)**sections to the report. 6. (Optional) [Organize the report’s contents and layout](https://knowledge.threatconnect.com/docs/organizing-editing-previewing-and-deleting-a-report#organizing-a-report). 7. [Save, publish, or export the report](https://knowledge.threatconnect.com/docs/saving-publishing-and-exporting-a-report). ### Creating a Report From a Case Report Template Follow these steps to create a report for a Case from a saved Case report template: 1. Click **Workflow** on the top navigation bar. Alternatively, hover over **Workflow**on the top navigation bar and select **Cases**. 2. Select a Case on the **[](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases)** [](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases)[**Cases**screen](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases) [](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases)**[](https://knowledge.threatconnect.com/docs/viewing-managing-and-filtering-cases)** to [view the Case's details](https://knowledge.threatconnect.com/docs/parts-of-a-case#viewing-a-case). 3. Click **+ Create Custom Report**at the top right of the Case and select **Create From Case Report Template…**. NoteYou can also access the **+ Create Custom Report**button on a [Case’s **Details**drawer](https://knowledge.threatconnect.com/docs/the-details-drawer-for-workflow-cases) while the drawer is open on the **[](https://knowledge.threatconnect.com/docs/viewing-search-results)** [](https://knowledge.threatconnect.com/docs/viewing-search-results)[**Search** screen](https://knowledge.threatconnect.com/docs/viewing-search-results) [](https://knowledge.threatconnect.com/docs/viewing-search-results)**[](https://knowledge.threatconnect.com/docs/viewing-search-results)**. 4. Select a saved Case report template on the **Create From Case Report Template**window, and then click **Create Custom Report**. The **Report Editor**will open and display a new report based on the selected Case report template (Figure 5). ![Figure 5_Creating a Report_7.6.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_Creating%20a%20Report_7.8.0.png) NoteIf there are one or more sections in the report that are not populated with data, a message stating “One or more sections are empty.” will be displayed at the top of the **Report Editor**. To remove the empty sections, click **Remove Empty Sections**in this message, or click **Remove**in the **Report Editor**toolbar and select **Empty Sections**. 5. Review the report to identify placeholder sections that need to be configured manually. Hover over each placeholder section, click **Edit Content![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20Content%20icon_Reports.png)**,****and provide the required information. Alternatively, click **Remove Placeholders**in the **Report Editor**toolbar to remove all placeholder sections in the report. 6. (Optional) Click **+ Add Section**in the **Report Editor**toolbar to add additional **[Case Data](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report)**, **[Basic Elements](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report)**, and **[Layout Elements](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report)**sections to the report. 7. (Optional) [Organize the report’s contents and layout](https://knowledge.threatconnect.com/docs/organizing-editing-previewing-and-deleting-a-report#organizing-a-report). 8. [Save, publish, or export the report](https://knowledge.threatconnect.com/docs/saving-publishing-and-exporting-a-report). ### Creating a Report From a Generic Report Template Follow these steps to create a generic report (i.e., a report that is not for a specific Group or Case) from a saved generic report template: 1. Click **Reporting**on the top navigation bar. 2. Click **+ Create Custom Report**at the top right of the **[](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports)** [](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports)[**Reporting**screen](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports) [](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports)**[](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports)** and select **Create From Generic Template…**. 3. Select a saved generic report template on the **Create From Generic Report Template**window, and then click **Create Custom Report**. The **Report Editor**will open and display a new report based on the selected generic report template, as well as the **Add Section**drawer (Figure 6). ![Figure 6_Creating a Report_7.6.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_Creating%20a%20Report_7.8.0.png) NoteIf there are one or more sections in the report that are not populated with data, a message stating “One or more sections are empty.” will be displayed at the top of the **Report Editor**. To remove the empty sections, click **Remove Empty Sections**in this message, or click **Remove**in the **Report Editor**toolbar and select **Empty Sections**. 4. (Optional) On the **Add Section**drawer, select [**Intelligence Data**](https://knowledge.threatconnect.com/docs/adding-intelligence-data-to-a-report), [**Basic Elements**](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report), and [**Layout Elements**](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report) sections to add to the report. You may also close the **Add Section**drawer and reopen it later by clicking **+ Add Section**in the **Report Editor**toolbar. 5. Review the report to identify placeholder sections that need to be configured manually. Hover over each placeholder section, click **Edit Content![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20Content%20icon_Reports.png)**, and provide the required information. Alternatively, click **Remove Placeholders**in the **Report Editor**toolbar to remove all placeholder sections in the report. 6. (Optional) [Organize the report’s contents and layout](https://knowledge.threatconnect.com/docs/organizing-editing-previewing-and-deleting-a-report#organizing-a-report). 7. [Save, publish, or export the report](https://knowledge.threatconnect.com/docs/saving-publishing-and-exporting-a-report). --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20144-02 v.04.C