Reports Module

Introduction to Reports module

You can access Reports module by pressing button and you will find them in top-left section of Web Interface.

In addition to opening the Reports module and act on included reports as explained in this chapter, the Web Interface provides a quick search for the desired report. In order to search for a report, type in the report name, or a part of it, in Quick Filter box at the top-right corner of the interface.

Typing creates a dynamic drop-down list of matching reports. By selecting a report in list, you are taken directly to that report's details in Reports module.

The module facilitates scheduled and ad hoc reporting, all at once or granularly, in order to gain a complete compliance and operational summary into IT. The module interface allows users to view only those reports for which they are authorized. Using a simple, Web-based interface, you'll be able to quickly access the tool's predefined and customizable reports and begin gaining value.

Types of Reports

Available Reports

In CYBERQUEST Reports Module you can find technological and compliance reports. The report tree is structured as follows:

• By accessing Best Practices folder, you will find a list of frequently used technology reports by customers which is summarized and detailed technology best practices reports.

• By accessing Compliance folder, you will be presented with all reports mapped to included compliance standards, where addressed compliance requirements are listed accordingly.

• By accessing Custom Reports folder, you will be able to access reports not included by default with CYBERQUEST.

• By accessing GDPR folder, you will be presented with a list of GDPR reports.

• By accesing Linux folder, you will be able to access Linux reports.

• By accessing any of the Technology Reports folder, you will be presented with summarized and detailed reports for that technology, designed to assist an operator reporting on compliance issues.

• By accessing Windows folder, you will be presented with a list of Windows reports.

• 

Compliance Reports

CYBERQUEST built-in reports are designed to ensure compliance with the following standards:

• COBIT (Control Objectives for Information and Related Technology)

• FISMA (Federal Information Security Management Act)

• GDPR (General Data Protection Regulation)

• HIPAA (Health Insurance Portability and Accountability Act)

• ISO 27001 (Information Security Standard)

• PCI DSS (Payment Card Industry Data Security Standard)

• SOX (Sarbanes-Oxley Act)

Managing Reports

To create, to edit and delete a folder, please access the Reports Module from Web Interface and the window will open:

• Creating a new folder press button and page will open:

In Name field, the name of the New Folder. This name will appear in Reports list.

In Description field, insert a description of the New Folder.

In Parent field, select the location where you want to add the New Folder.

Complete the form and press "Save" button to save changes, or "Cancel" button to close the window without saving.

• If you want to edit a folder press click on Reports Folder to see all the folders, and after press button:

This process is almost identical with create a New Folder.

• To delete a folder press click on Reports Folder to see all the folders, and after press button:

As a measure of precaution, you will be asked to confirm deletion and press button, and you can cancel the deletion by pressing the button.

Create Custom Reports

By accessing Custom Reports folder, you will be able to access reports not included by default with CYBERQUEST.

Navigate to “Dashboards" module, which can be accessed when first logging in to application or by pressing button at any time in top-left section of Web Interface.

Create a filtering rule, in which case we will filter the self-audit events using the following filtering rule (e.g. EventID:"56789") . Save as a report by clicking on “SAVE OPTIONS” > "Save as New Report".

Complete the form

Complete the form with the appropriate information and press the button.

Name: The name of the new Report;

Description: The description for the new Report;

Save the reports

Choose the fields with the desired information and press the button.

The report will be saved on the "Reports" page, in "Custom reports" folder.

Schedule Reports

When selecting Schedules in Reports and schedules section of the Reports module interface, a list with all report schedules defined is presented.

For any of the schedules listed here, you can edit and delete them.

You also can create a New Schedule pressing button, and window will open:

• In Name field, complete with a representative name for your scheduled report or leave as default

• In Report field, you will have a drop-down list and you have to select a source report.

• In Filter Data field, you have to complete with a filtering query.

• In Schedule Type field, you will find a drop-down list and you can choose between Daily, Weekly or Monthly values.

• In Hour field, choose an hour when you want the report executed.

• In Email addresses field, you have to complete with an email addresses of your intended recipients. Email addresses must be entered one per line, with no punctuation separators. There is no limit to the number of recipients allowed by scheduling engine.

Press "Save" button to create a new schedule or "Cancel" to cancel your action and return to the main interface.

Working with Reports module

Reports module interface is divided in two sections:

• Reports and schedules section allows you to navigate the reports folder structure and to select the report you want to action on, as well as creating, editing and deleting report schedules.

• Reports detail section allows you to edit, delete and execute a selected report.

Report detail window

When selecting a report from reports list, you are presented with a report detail window on the right, allowing you to edit, delete or execute the selected report.

The detail window includes the following elements:

• Report title and description in top-left corner presents with a full path and name for the selected report, and the report description;

• Edit button on the top-right corner allows you to edit selected report;

• Delete button next to it allows you to delete selected report;

• Report execution options allow you to execute a report filtered as needed.

Executing reports

To execute a report, make sure execution options are displayed.

Execution options allow you to control in detail what data will be included in report:

• You can set a specific Start Date and End Date for reported data.

• By pressing Items on page drill-down, you can select from 100, 50 and 10 items to be displayed on each page.

• If checking Time interval box, you can choose for each day in your selection, which time interval will be reported on.

• Note time reference on the right (local time, GMT, or ReceivedTime). Function of selected option, the reported data will change time values accordingly.

• The Filter Data text box allows you to filter which information will be included in report, based on the free text searches entered here. The text box acts like the Search field in Dashboards, Browser and Investigations modules and supports the same syntax.

• The drill-down below Filter Data text box allows you to select which event fields will be added to report. By default, the report includes only Computer, Description, Destination IP and LocalTime listed as report columns. Check or uncheck any other field you consider being needed.

• You can schedule the report to be executed with selected options. In order to do that, press button in details window. Add/Edit schedule pop-up window opens:

In Name field, enter a representative name for your scheduled report or leave as default

Report drop-down list will be pre-populated with the source report. You can change the report you want executed from here

Filter Data text box includes the filtering query introduced in main Report detail window. You can edit the text as needed

In Schedule Type drop-down list, you can choose between Daily, Weekly or Monthly values. Your selection options will change accordingly

In Hour field, choose an hour when you want the report executed

In Email addresses text box, enter the email addresses of your intended recipients. Email addresses must be entered one per line, with no punctuation separators. There is no limit to the number of recipients allowed by scheduling engine.

Press "Save" button to create a new schedule or "Cancel" to cancel your action and return to the main interface.

In main interface, press button to execute the report. Execution time depends on the query complexity, volume of data to be searched, and the number of items to be displayed. A simple search will list any volume in a matter of seconds.

All report results are dynamic and allow an operator to further extend the reporting action scope.

By clicking on a report field other than Description, a persistent pop-up menu opens allowing the user to:

• Create a new search in Dashboards, Investigations or Browser module for all events with specified field value. The module opens in a new browser tab

• Create a new alert in Alerts module, for all events with specified field value. The module opens in a new browser tab

• Further filter the report by listing only selected data. The search in Filter Data text box changes accordingly

• Further filter the report by excluding selected data from list. The search in Filter Data text box changes accordingly

By clicking the arrow button at the beginning of each event row, you will be able to instantly export the event in JSON format.

Managing report schedules

When selecting Schedules in Reports and schedules section of the Reports module interface, a list with all report schedules defined is presented.

For any of the schedules listed here, you can edit and delete them. You can also create a new schedule by pressing New Schedule button.

Adding a new schedule or editing an existing one opens Edit schedule pop-up window described above.

Editing reports

To edit a selected report, press button on the top-right corner of the Reports interface. Edit Report pop-up window opens:

• In Name field, change the report name or leave as default

• Parent drop-down list allows you to move the report to a different folder in reports structure

• In Description field, change the provided description or leave as default

• Parent drop-down list allows you to move the report to a different folder in reports structure

• In Description field, change the provided description or leaves default

Press "Save" button to save your changes or "Cancel" to cancel your action and return to the main interface.

Deleting reports

To delete a selected report, press button on the top-right corner of the Reports interface.

A confirmation window will ask you to press to delete the report, or press to cancel your action and return to the main interface.

Export data from reports

The module facilitates scheduled and ad hoc reporting, all at once or granularly, in order to gain a complete compliance and operational summary into IT.

To see how to export data from Reports, please follow the link: How to export data from Reports.

Import reports

You can also import a report definition from an external CQO file, which is CYBERQUEST's proprietary format.

In order to import a report definition, press button.

After, you have to choose file which you want to import and the Parent (the location where you want to add the New Folder) of the reports.

Report execution scenario example

Step 1: Access the Reports module from Web Interface.

Step 2: By navigating to Windows reports folder, select Windows All user activities report.

Step 3: Select a start and end date for your report.

Step 4: In the additional filter field both simple and complex filters can be added with the help of logical operators AND, OR and NOT, for example for a search that results from only certain users and a category (ex: Logoff) a complex filter can be created like this:

(UserName: dc04$) AND (Category:File System)

Step 5: The search results will be displayed in the bottom part of the web page in ascending chronological order; for details pertaining to events, the respective field needs to be clicked. In the result display field, the number of pages on which the results appear is shown and displayed and also the number of total results ("Total results") and current page.

How to create a new report and how to run it

To see how to create a new report, please follow the link: How to create a new report and how to run it