Reports
A report script queries the data lake over a time range, shapes the results into tables, metrics and alerts, and returns them for rendering in a dashboard or delivery on a schedule. The recipes here are complete working scripts from live deployments, covering the two things reports are most often asked for: operational accounting — what is being ingested, from where, and at what volume — and security summaries built on behavior events and identity activity. They double as templates, since the query-shape-return pattern is the same whatever the subject.
Operational reports
- EventIngress — total event ingress over a time range, broken down by source, sender and event type. The starting point for volume and cost questions.
- LoadResources_AD — a skeleton for loading Active Directory assets into resource tables, filtering out disabled accounts.
Security reports
- BehaviorSummary — an executive summary of behavior, key and level events across a range, with the top behavior rules by hit count.
- AzureAD_Logins — AzureAD login statistics grouped by application, user, operating system, browser, country, city and unique users.
- Office365_UserActivityInvestigation — an investigation report showing one Office 365 user's activity over a period.
Related
- Cookbooks — the recipe library this belongs to.
- Parser cookbooks — the other half of the library.
- Creating a Report — the task guide these recipes support.
- Report Cookbook — additional report material in the main manual.
- Scheduling and Delivery — running these on a schedule.
- FPL Reference — the language these recipes are written in.