Reports
A report script queries the data lake over a time range, shapes the results into tables, metrics and alerts, and returns them for rendering in a dashboard or delivery on a schedule. The recipes here are complete working scripts from live deployments, covering the two things reports are most often asked for: operational accounting (what is being ingested, from where, and at what volume) and security summaries built on behavior events and identity activity. They double as templates, since the query-shape-return pattern is the same whatever the subject.
Operational reports
- EventIngress: total event ingress over a time range, broken down by source, sender and event type. The starting point for volume and cost questions.
- LoadResources_AD: a skeleton for loading Active Directory assets into resource tables, filtering out disabled accounts.
Security reports
- BehaviorSummary: an executive summary of behavior, key and level events across a range, with the top behavior rules by hit count.
- AzureAD_Logins: AzureAD login statistics grouped by application, user, operating system, browser, country, city and unique users.
- Office365_UserActivityInvestigation: an investigation report showing one Office 365 user's activity over a period.
Related
- Cookbooks: the recipe library this belongs to.
- Parser cookbooks: the other half of the library.
- Creating a Report: the task guide these recipes support.
- Report Cookbook: additional report material in the main manual.
- Scheduling and Delivery: running these on a schedule.
- FPL Reference: the language these recipes are written in.