Run a report

Procedure

1. Select Reports → Templates , and then select a report.
2. Click the arrow on the left side of the report template name, and use the criteria panels to limit the results of your report.
   Depending on the report, some filters are selected by default (i.e., every severity filter is selected for the All Destinations reports) and others include required fields that must be completed before you can run a report (i.e., you must provide a filter name or filter number to run the Specific Attack report). Your applied filters display in italics to the right of the criteria panel name.
3. (Optional) Click Customize Query to build a custom report formula. For more information about building a criteria query, see Customize a query.
4. (Optional) From the Last Hour drop-down list, adjust your time frame from the following:
   • Last —Select a standard time interval, such as last minutes, hours, days, or month.
   • User Defined — Type in the field, or click the calendar to select a time duration between two dates (Start Time and the End Time).
   • General — Click Edit to choose a custom range by selecting a day of the month or day of the week, and then specifying the duration in hours and 5-minute intervals.
   • Incremental - Choose increments of minutes, hours, days, or weeks.
5. Click Run.

   Important The time required to process a report varies, as many variables affect the amount of time needed for a report to process, such as the time range, the number or type of filters, the number of events accumulated within the time range, and other activities processed by SMS when the report runs including the number of events, additional reports or queries executed at that time, and any database maintenance. Reports run with Last Hour criteria do not include a full hour of data due to an extract, transform, and load (ETL) process that occurs every five minutes. Reports are typically missing a five minute window of events that haven't been processed through ETL.

   Note Percentages in reports are usually rounded to the nearest integer; therefore, total percentages do not always add up to 100.

6. From the generated report, you can perform a variety of functions:
   • Drill down in to view Event details. Click a Filter Name in the report to view the Reputation Events for the selected filter name. The criteria for the event matches the criteria that was assigned when the report was generated, such as the name of the filter and the IP address.
   • Save, save as a custom template, or print the report. For more information about saving a report template, see Create a saved report.