Reports

Overview

ThreatConnect^® includes a built-in reporting feature that lets you collect and organize valuable information about Groups and Cases in a document that you can share with teammates, executives, and stakeholders. Unlike a Report Group, which is a Group object containing a file uploaded to ThreatConnect, a report is a customized document that can have any of the following components:

• Details about one or more Groups, including each Group's name, type, owner, creation date, last modified date, Security Labels, and Tags
• Details about one or more Cases, including each Case’s status, resolution, severity, Time of Occurrence, Time of Detection, Open Time, Close Time, description, and Tags
• Summaries of one or more Attributes added to a Group or Case
• Tables displaying objects associated to a Group or Case
• AI-generated summaries for Report Groups in the CAL™ Automated Threat Library Source
• Visual elements, such as saved Group or Case graphs from Threat Graph and images
• Query-based charts and tables, metric charts, and pre-configured tables
• Text blocks that support rich text formatting, code blocks, and inline images
• Page layout elements, such headers, footers, page breaks, and horizontal rules

After you build out a report, you can save it so that you and other users in your Organization can view it on the Custom Reports tab of the Reporting screen. You can also share a report via email, export it as a PDF or HTML file, and publish it as a Report Group with the report attached as a PDF or HTML file.

In addition to reports, you can create report templates that standardize the report creation process for users. Report templates can include content blocks with preconfigured text or visual elements, such as charts, images, tables, and saved graphs from Threat Graph, or placeholder sections that users can fill in after they create a report from the template. Saved report templates are available on the Templates tab of the Reporting screen, and users can leverage them when creating Group, Case, and generic reports.

In This Series

• Creating a Report: Learn how to create reports from scratch, as well as from report templates.
• Adding Intelligence Data to a Report: Learn how to add Intelligence Data sections to a report.
  • Adding Group Data to a Report: Learn how to add Group Data sections to a report and configure each type of section.
  • Adding Case Data to a Report: Learn how to add Case Data sections to a report and configure each type of section.
• Adding Basic Elements to a Report: Learn how to add Basic Elements sections to a report and configure each type of section.
• Adding Layout Elements to a Report: Learn how to add Layout Elements sections to a report and configure each type of section.
• Organizing, Editing, Previewing, and Deleting a Report: Learn how to organize a report, edit a report, preview a report as a PDF, and delete a report.
• Saving, Publishing, and Exporting a Report: Learn how to save a report, publish a report as a Report Group, and share a report via email or as an exported PDF or HTML file.
• Report Templates: Learn how to create, manage, and use report templates.
• Viewing and Managing Saved Reports and Templates: Learn about the Reporting screen in ThreatConnect, which is where you can view and manage all reports and templates you and other users in your Organization have saved.

ThreatConnect^® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20144-01 v.04.A