Skip to main content

Report Cookbook

Working code beats a blank editor. This page routes to the report scripts in the appendix and says what each one demonstrates. Read Creating a Report first for the mechanics; come here to find something close enough to adapt.

How to Use a Recipe​

Read, Then Clone​

Find the recipe closest to the question, read what it does, then get an editable copy rather than pasting into an empty editor: open the report on the FPL reports tab of Reports and save it under a new name (Save as Processor on a system report; v1: Clone on Reports → Processors), or, in the v1 interface, use Import Report with an exported definition.

Adapt the Selection​

What almost always has to change: index names, field names, and the time window. See Normalization for field naming.

Adapt the Arguments​

Re-point the recipe's arguments at your own defaults before scheduling it, and check that the recurrence and the window agree.

Test Before Scheduling​

Run once over a short window (from the report's editor, or from the v1 Scheduler's run dialog), read the output, then schedule.

Existing Recipes​

The report scripts in the appendix.

AzureAD_Logins​

Sign-in reporting over Azure AD / Entra ID authentication telemetry. Demonstrates selecting an identity-provider index and summarizing authentication outcomes. See AzureAD_Logins.

BehaviorSummary​

Reporting over the platform's own behavior-summary tickets rather than over raw telemetry. Demonstrates reporting on the SIEM's output: the natural basis for a SOC metrics report, including AI closure rates. See BehaviorSummary for the report, and Behavior Summary for the page the tickets it counts are worked on (v1: SIEM → Behavior Summary).

EventIngress​

Volume reporting over data arriving in the platform. Demonstrates ingest accounting and is the basis for capacity and licensing reports. See EventIngress for the report, and the Event Ingress Report and Usage Report for the built-in charts covering the same ground (v1: Platform → Usage).

LoadResources_AD​

A Task rather than a report to read: it loads Active Directory data into a resource table for other content to enrich against. Demonstrates the Task category and the resource-loading pattern. See LoadResources_AD for the task, and Resources for the table it writes into (v1: SIEM → Resources).

Office365_UserActivityInvestigation​

A per-subject investigation report driven by a username argument. Demonstrates the on-demand, argument-driven pattern where one processor serves any user under investigation. See Office365_UserActivityInvestigation.

Last updated on