Applies to Product: | USM Appliance™ | LevelBlue OSSIM® |
If predefined reports in USM Appliance do not suit your needs, you can either modify an existing report or generate a new report from scratch. Both options use the Report Wizard.
Note: In order to add the custom report as a dashboard widget, keep the report name under 42 characters.
This section covers the following subtopics:
So that you can continue to receive improvements to your built-in USM Appliance reports from USM Appliance updates, if you want to modify a report, you need to modify a copy of the report.
To modify a built-in report
- Select a report you want to modify.
- Click the copy icon ().
-
By default, the system adds "_1" to the original name of the report. Modify it if you want, and then click Save.
The Report Wizard displays.
-
Go through the wizard to make modifications as needed.
- In step 1, you can add modules to or remove them from the report.
- In step 2, you can change the asset selection.
-
In step 3, you can modify the parameters for the selected report modules. For example, you can set DS Group to cut down the number of events covered in the report.
Note: You cannot change the graphs or tables.
-
To save the report without running it, click Save; to save the report and run it immediately, click Save & Run.
The report appears in Custom Reports. You can run it the same way as a USM Appliance built-in report, and you can modify the settings in the report by clicking the edit icon (), which will run through the Report Wizard again.
You can create a new custom report from scratch by going through the Report Wizard.
To create a new custom report
-
Go to Reports > All Reports, and then in Actions select Create Report.
The Report Wizard displays.
-
Go through the wizard as follows,
- In step 1, type a name for the report, modify the date range, and then select the modules you want to use.
- In step 2, select the asset(s) you want to include.
- In step 3, modify the parameters for the selected report modules, as needed. For example, you can set the DS Group to cut down the number of events covered in the report.
-
To save the report without running it, click Save; to save the report and run it immediately, click Save & Run.
The report appears in Custom Reports. You can run it the same way as a USM Appliance built-in report, and you can modify the settings in the report by clicking the edit icon (), which will run through the Report Wizard again. By default, a custom report does not include a title page. If you want to include a title page, add the Title Page module in step 1 of the wizard.
Important: If the user who created a scheduled report is deleted from USM Appliance, the scheduled reports they had created will also be removed.
If the default look and feel of reports does not suit your company's requirements, you can create a custom layout with customized icons, footers, and/or color schemes.
To create a custom layout
- Go to Reports > All Reports, and then Layouts.
- Click New Layout.
- In the Name field, type a name for the new layout.
- In the Permissions field, select All or the context that has permission to use this layout.
- Select the background and foreground colors for the title and subtitles.
-
Customize the left and right footers. The parameters display on the right-hand side.
USM Appliance replaces the parameters in the footer with actual values when running the report.
- Upload an image file (.gif, .png, or .jpg) to use in the header for the PDF report.
- Click Save.
You can use the layout when modifying a report or creating a new report.