---
title: "Report Templates | ThreatConnect"
slug: "report-templates"
description: "This article describes how to create, manage, and use a report template in ThreatConnect."
tags: ["Analytical Tools"]
updated: 2025-02-03T22:22:40Z
published: 2025-02-03T22:22:40Z
canonical: "knowledge.threatconnect.com/report-templates"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Report Templates

## Overview

Report templates allow you to define a standard format users can follow when they create reports in ThreatConnect®, ensuring consistency across your team’s reports and eliminating time spent creating reports from scratch.

When building a report template, you can add content blocks with preconfigured text or visual elements, such as charts, images, tables, and [saved Threat Graphs](https://knowledge.threatconnect.com/docs/viewing-all-graphs-saved-in-threat-graph), or placeholder sections that users can fill in after they create a report from the template. Once you customize and save a report template, users in your Organization can use it when [creating a report](https://knowledge.threatconnect.com/docs/creating-a-report) for a Group, a report for a Case, or a generic report (i.e., a report that is not for a specific Group or Case).

NoteAt this time, no out-of-the-box report templates are available in ThreatConnect.

## Before You Start

### User Roles

- To create, edit, save, organize, and delete report templates, your user account must have an [Organization role](https://knowledge.threatconnect.com/docs/organization-roles) of Standard User, Sharing User, Organization Administrator, or App Developer.
- To create reports from a report template, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer.

## Creating a Report Template

Follow these steps to create a report template in ThreatConnect:

1. Click **Reporting** on the top navigation bar.
2. Click **+ Create Template**at the top right of the **Reporting**screen and select the type of report template to create (**Case**, **Generic**, or **Group**). After you select a report template type, the **Template Editor** will open and display a blank report template of the selected type, as well as the **Add Section**drawer. Figure 1 shows a blank Group report template.  
NoteBy default, newly created report templates contain placeholder **Report Header**and **Report Footer**sections.![Figure 1_Report Templates_7.5.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Report%20Templates_7.8.0.png)
3. On the **Add Section**drawer, select the [sections to add to the report template](/docs/report-templates#adding-content-to-a-report-template).
4. (Optional) [Organize the report template’s contents and layout](/docs/report-templates#organizing-a-report-template).
5. Click **Save Template**at the top right of the **Template Editor** to [save the report template](/docs/report-templates#saving-a-report-template).

## Adding Content to a Report Template

When you have a report template open in the **Template Editor**, you can add content to it from the **Add Section**drawer. To open this drawer, click **+ Add Section**in the **Template Editor** toolbar.

The sections you can add to a report template belong to one of the following categories and depend on the type of report template you have open in the **Template Editor**:

- [**Group Data Placeholder**](/docs/report-templates#group-data-placeholder) (available for Group report templates only)
- [**Case Data Placeholder**](/docs/report-templates#case-data-placeholder) (available for Case report templates only)
- [**Basic Elements**](/docs/report-templates#basic-elements) (available for Group, Case, and generic report templates)
- [**Layout Elements**](/docs/report-templates#layout-elements) (available for Group, Case, and generic report templates)

### Group Data Placeholder

**Group Data Placeholder**sections, available for Group report templates, are placeholder sections that correspond to the following **Group Data**sections for reports:

- [Details](https://knowledge.threatconnect.com/docs/adding-group-data-to-a-report#details)
- [Attributes](https://knowledge.threatconnect.com/docs/adding-group-data-to-a-report#attributes)
- [Group Associations](https://knowledge.threatconnect.com/docs/adding-group-data-to-a-report#group-associations)
- [Indicator Associations](https://knowledge.threatconnect.com/docs/adding-group-data-to-a-report#indicator-associations)
- [Victim Assets Associations](https://knowledge.threatconnect.com/docs/adding-group-data-to-a-report#victim-assets-associations)

After you select a **Group Data Placeholder**section from the **Add Section**drawer, you will be prompted to select the section’s format in the report template. There are two formats available for each of the **Group Data Placeholder**sections:

- **Placeholder Block**: A placeholder block reserves space in a report template for a **Group Data**section without needing you to configure the information the section will display in reports created from the template. Use placeholder blocks when you want to show all of a Group’s details, have users pick a specific Group Attribute to include, or display a table that shows all of a Group’s associated Groups, Indicators, or Victim Assets in reports created from the template.  
NoteIf you add an **Attributes** section to a Group report template as a placeholder block, users who create reports from the template must edit the **Attributes**section in the report and select an [Attribute](https://knowledge.threatconnect.com/docs/attributes) to use in the section.
- **Custom Placeholder Block**: A custom placeholder block reserves space in a report template for a **Group Data**section and lets you [configure](https://knowledge.threatconnect.com/docs/adding-group-data-to-a-report) the information the section will display in reports created from the template. Use custom placeholder blocks when you want to show a subset of a Group’s details, include all of a Group’s Attributes of a specific set of Attribute Types, or display a custom table that shows a filtered set of a Group’s associated Groups, Indicators, or Victim Assets in reports created from the template.  
NoteIf you add one or more **Attributes** sections to a Group report template as custom placeholder blocks, separate sections for each selected Attribute Type will be added to the template. When users create reports from the template, an **Attributes** section for each Attribute the Group has of each selected Attribute Type will be added to the report.

When a user creates a report for a Group from a Group report template with **Group Data Placeholder**sections, each of the corresponding **Group Data** sections in the report will be populated with their respective data from the Group.

### Case Data Placeholder

**Case Data Placeholder**sections, available for Case report templates, are placeholder sections that correspond to the following **Case Data**sections for reports:

- [Details](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#details)
- [Attributes](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#attributes)
- [Group Associations](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#group-associations)
- [Indicator Associations](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#indicator-associations)
- [Case Associations](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#case-associations)
- [Potential Group Associations](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#potential-group-associations)
- [Potential Indicator Associations](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#potential-indicator-associations)
- [Potential Case Associations](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#potential-case-associations)
- [Artifacts](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#artifacts)
- [Notes](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#notes)
- [Timeline](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report#timeline)

If you select the **Details**, **Attributes**, **Group Associations**, or **Indicator Associations** sections from the **Case Data Placeholder**section of the **Add Section**drawer, you will be prompted to select the section’s format in the report template. There are two formats available for these **Case Data Placeholder**sections:

- **Placeholder Block**: A placeholder block reserves space in a report template for a **Case Data**section without needing you to configure the information the section will display in reports created from the template. Use placeholder blocks when you want to show all of a Case’s details, have users pick a specific Case Attribute to include, or display a table that shows all of a Case’s associated Groups or Indicators in reports created from the template.  
NoteIf you add an **Attributes** section to a Case report template as a placeholder block, users who create reports from the template must edit the **Attributes**section in the report and select a [Case Attribute](https://knowledge.threatconnect.com/docs/case-attributes) to use in the section.
- **Custom Placeholder Block**: A custom placeholder block reserves space in a report template for a **Case Data**section and lets you [configure](https://knowledge.threatconnect.com/docs/adding-case-data-to-a-report) the information the section will display in reports created from the template. Use custom placeholder blocks when you want to show a subset of a Case’s details, include all of a Case’s Attributes of a specific set of Attribute Types, or display a custom table that shows a filtered set of a Case’s associated Groups or Indicators in reports created from the template.  
NoteIf you add one or more **Attributes** sections to a Case report template as custom placeholder blocks, separate sections for each selected Attribute Type will be added to the template. When users create reports from the template, an **Attributes** section for each Attribute the Case has of each selected Attribute Type will be added to the report.

If you select the **Case Associations**, **Potential Group Associations**, **Potential Indicator Associations**, **Potential Case Associations**, **Artifacts**, **Notes**, or **Timeline** section from the **Case Data Placeholder**section of the **Add Section**drawer, the section will be added to the Case report template as a placeholder block automatically.

NoteIf you add a **Notes** section to a Case report template, users who create reports from the template must edit the **Notes**section in the report and select a [Case Note](https://knowledge.threatconnect.com/docs/case-notes) to use in the section.

### Basic Elements

You can add any of the following **Basic Elements**sections to a Group, Case, or generic report template:

- [Chart](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report#chart)
- [Threat Graph](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report#threat-graph)
- [Image](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report#image)
- [Table](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report#table)
- [Text Block](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report#text-block)

After you select a **Basic Elements**section from the **Add Section**drawer, you will be prompted to select the section’s format in the report template. There are two formats available for each of the **Basic Elements**sections:

- **Placeholder Block**: Placeholder blocks act as prompts that indicate where users should add specific information and elements to reports created from a report template. If a **Basic Elements**section is added to a report template as a placeholder block, users must [configure](https://knowledge.threatconnect.com/docs/adding-basic-elements-to-a-report) the section after they create a report from the template.
- **Content Block**: Content blocks contain predefined visual and text-based elements that are populated automatically in reports created from a report template. If a **Basic Elements**section is added to a report template as a content block, users do not need to configure the section after they create a report from the template, as it will have already been configured in the template.

ImportantIf a **Threat Graph**section added to a saved report template contains a Threat Graph that has since been deleted, or if it contains a Threat Graph from an Organization you do not belong to (i.e., a Super User in your home Organization added a Threat Graph from a different Organization to the **Threat Graph**section), the section will change to a****placeholder block in the report template and reports created from it. In addition, a message stating “One or more sections have errors.” will be displayed at the top of the **Template Editor**and **Report Editor** when viewing the report template or reports created from it, respectively. In this scenario, edit the **Threat Graph**section and select a different Threat Graph to use in the section.ImportantIf a **Chart**or **Table**section Is added to a report template as a content block, but returns no data, a message stating so will be displayed within the section in the report template and reports created from it. In this scenario, the section will be considered an empty section.

### Layout Elements

You can add any of the following **Layout Elements**sections to a Group, Case, or generic report template:

- [Report Header](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report#report-header)
- [Report Footer](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report#report-footer)
- [Divider](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report#divider)
- [Page Break](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report#page-break)

By default, new report templates include placeholder **Report Header**and **Report Footer**sections.

## Organizing a Report Template

As you build out a report template, you may want to organize its contents and layout. To do so, hover over a section in the report template while it is open in the **Template Editor**and select one of the following options:

- **Move Content Up![Move Content Up icon_Reports](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Move%20Content%20Up%20icon_Reports.png)**: Select this option to move the section further up in the report template.
- **Move Content Down![Move Content Down icon_Reports](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Move%20Content%20Down%20icon_Reports.png)**: Select this option to move the section further down in the report template.
- **+ Add Above**: Select this option to add a section above the current section.
- **+ Add Below**: Select this option to add a section below the current section.

NoteThe **+ Add Above**and **+ Add Below**options are helpful when you want to add a [**Divider**](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report#divider)****or [**Page Break**](https://knowledge.threatconnect.com/docs/adding-layout-elements-to-a-report#page-break)****section between two sections in a report template.

## Editing a Report Template

While you have a report template open in the **Template Editor**, you can edit the template’s name and manage the sections in the template.

### Editing a Report Template’s Name

Click **Edit![Edit button_Details card_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20button_Details%20card_Details%20screen.png)**at the top left of the **Template Editor** to edit the report template’s name. After you enter a new, unique name for the report template, click **Confirm![Confirm icon_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Confirm%20icon_Details%20screen.png)**.

### Managing Sections in a Report Template

#### Editing a Section in a Report Template

Hover over a section in a report template and select **Edit Content![Edit Content icon_Reports](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20Content%20icon_Reports.png)**at the top right of the section to edit it.

#### Removing a Section From a Report Template

Hover over a section in a report template and select **Remove Content![Remove Content icon_Reports](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Remove%20Content%20icon_Reports.png)**at the top right of the section to remove it from the template. If you removed a section by accident, click **Undo**in the confirmation message at the lower-left corner of the screen to re-add the section.

## Saving a Report Template

Saving a report template allows you and other users in your Organization to access it from the **Templates**tab of the [**Reporting**screen](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports) and use it when [creating reports](https://knowledge.threatconnect.com/docs/creating-a-report#creating-a-report-from-a-report-template). Depending on whether you are working with a saved or unsaved report template, the options available when saving the report template will differ.

NoteIf you try to refresh, navigate away from, or close a browser tab displaying an unsaved report template or a saved report template with unsaved changes, you will be prompted to confirm the intended action, as doing so will result in the loss of any unsaved changes.ImportantIf you are a Super User, it is recommended that you identify whether a report contains data from Organizations outside of your home Organization in the report’s description when saving it so that other users in your home Organization do not attempt to open the report. (See [*Managing Data in All Organizations: Reports and Report Templates*](https://knowledge.threatconnect.com/docs/managing-data-in-all-organizations-reports-and-report-templates) for more information.)

### Saving a New Report Template

Follow these steps to save a new (i.e., unsaved) report template that is open in the **Template Editor**:

1. Click **Save Template**at the top right of the **Template Editor**.  
NoteIf there are no sections added to a report template, the **Save Template**button will be grayed out.
2. Fill out the fields on the **New Template**window as follows:
  - **Name**: Enter a unique name for the report template. The default value in the **Name**field will be the name listed at the top left of the **Template Editor**.
  - **Description**: (Optional) Enter a description of the report template.
3. Click **Save**on the **New Template**window.

### Saving Changes to a Saved Report Template

If you have a saved report template open in the **Template Editor**, click **Save Template**at the top right of the screen and select**Save Changes** to save any changes made to the report template since it was last saved.

### Saving a Copy of a Saved Report Template

Follow these steps to save a copy of a saved report template that is open in the **Template Editor**:

1. Click **Save Template**at the top right of the **Template Editor** and select **Save a Copy…**.
2. Fill out the fields on the **Save a Copy**window as follows:
  - **Name**: Enter a unique name for the report template. The default value in the **Name**field will be the name listed at the top left of the **Template Editor** with the text “ - COPY” appended to it.
  - **Description**: (Optional) Enter a description of the report template or update the existing description if one is present.
3. Click **Save**on the **Save a Copy**window.

NoteYou may also save a copy of a saved report template on the **Templates**tab of the [**Reporting**screen](https://knowledge.threatconnect.com/docs/viewing-all-saved-reports).

## Deleting a Report Template

If you have a saved report template open in the **Template Editor**, click the **⋯** menu at the top right of the screen and select **Delete…**to delete the report template.

NoteYou may also delete a saved report template on the **Templates**tab of the **[](https://knowledge.threatconnect.com/docs/viewing-and-managing-all-saved-reports-and-templates#managing-saved-reports-and-templates)** [](https://knowledge.threatconnect.com/docs/viewing-and-managing-all-saved-reports-and-templates#managing-saved-reports-and-templates)[**Reporting**screen](https://knowledge.threatconnect.com/docs/viewing-and-managing-all-saved-reports-and-templates#managing-saved-reports-and-templates) [](https://knowledge.threatconnect.com/docs/viewing-and-managing-all-saved-reports-and-templates#managing-saved-reports-and-templates)**[](https://knowledge.threatconnect.com/docs/viewing-and-managing-all-saved-reports-and-templates#managing-saved-reports-and-templates)**.

## Creating a Report From a Saved Report Template

See the [“Creating a Report From a Report Template” section of *Creating a Report*](https://knowledge.threatconnect.com/docs/creating-a-report#creating-a-report-from-a-report-template)**for instructions on creating reports from saved Group, Case, and generic report templates.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20144-11 v.03.B