Configuring the Report Data Source

The report data source is determined by two things: the time range of Job Action results included and, optionally, custom filter rules that determine what Job Action results are included.

Individual components where the Time Range or Filter Rules do not inherit the report's Data Source have a selectable tooltip . You can click the tooltip to view which Data Source rules have been overridden.

A Job Report's Data Source showing example time, rule, and error summary configuration

To Configure the Time Range of a Job Report or Individual Component

By default, all widgets added to a Job Report adhere to the time range you configure in the Report Data Source window. You can also configure a unique data source when editing individual widgets, in the Data Filter tab. Time ranges configured at the individual component level, or the Data Filter tab, override those configured in the Report Data Source window.

Using different time ranges in a single Job Report can help you compare security technology performance between specified time frames. For example, you can add four Stacked Bar Charts and use the Data Filter tab to set each chart's Time Range to a different fiscal quarter. This lets you compare activity trends between multiple quarters.

If you are adding unique Time Range rules in the Data Filter tab, you must clear the checkbox for Use the global time range (uncheck to override).

1. In the Analyze > Reports page, create a new report or use the Actions menu  to edit an existing report.
2. In the Report Data Source window or in a component's Data Filter tab, edit the Job Report's Time Range. Select either
   • Time Until Now (Relative), which lets you specify a window of time (relative to the current date and time) for job results to be pulled from.
   • Custom Range (Absolute), which lets you define an exact window of time for job results to be pulled from.

     By default, both Time Range options pull data from the last two weeks.

3. Click Apply.

To Add Filter Rules to a Job Report or Individual Component

By default, all widgets added to a Job Report adhere to the filter rules you configure in the Report Data Source window. You can also configure a unique data source when editing individual widgets, in the Data Filter tab. If no filter rules are added, the Job Report will use all Action data in the Validation Platform.

Rules configured at the individual component level, or the Data Filter tab, override those configured in the Report Data Source window.

If you are adding Filter Rules in the Data Filter tab, you must clear the checkbox for Use the global filter rules (uncheck to override).

1. In the Analyze > Reports page, create a new report or use the Actions menu  to edit an existing report.
2. In the Report Data Source window or in a component's Data Filter tab, click Add Rule.

3. Select an attribute to match against.

   Available attribute options relate to Action details, Job Action results, and Actors.

4. Select an additional attribute trait to match against. This varies depending on the Job Action attribute you select. See Data Source/Filter Rule Values in Job Reports and the MITRE ATT&CK Dashboard for the full list of options.
5. (Optional) Select either AND to add another condition to the rule or OR (Add Rule) to add another rule.
6. (Optional) Select the vertical ellipses (  ) next to a rule to clone or delete it.
7. Click Continue.

To Include Error Summaries in Report Panels

By default, when a Job Action errors, it is not included in the pass / fail or detected / alerted / missed data for Jobs. This means errored Job Actions are not automatically included in reports you build using Report Builder. If you want to include the errored Job Actions in the report, there is an option you can select.

Error Summaries are only available in the Data Tables.

1. In the Analyze > Reports page, create a new report or use the Actions menu  to edit an existing report.
2. In the Report Data Source window select Include Error Summaries in Report Panels.
3. Click Continue.

To Copy Data Filter Details Used in Another Component

If you have configured a component's rules differently from the Job Report's Data Source, you can copy those rules for easy use in other components. For example, you can choose to copy the rules you configured for a Data Table into your Stacked Bar Chart.

Your report must have at least one component/widget with customized data source rules for you to duplicate rules between components. See Adding Layout/Structure Components to a Job Report and Adding Content Widgets to a Job Report for information.

1. Open a Job Report for editing.
2. Expand a component's action menu  , then select Edit Widget.
3. In the Data Filter tab, clear the checkbox for Use the global filter rules (uncheck to override).
4. Under Copy overridden data rules from component, select another component from the drop-down list.

   Components with zero data rules may still appear in the drop-down list and can be selected. Components that inherit the report's Data Source are unavailable and cannot be selected.

   A message appears and displays the amount of rules that will be inherited from that component.

5. Click Continue.

   Previous rule configuration is overridden and the inherited rule is applied.

To Configure tags in report builder

You can add existing tags to reports or create your own. Tags allow you to search for and filter reports by tag.

1. In the Analyze > Reports page, create a new report or use the Actions menu  to edit an existing report.
2. In the Report Data Source window, click Continue.
3. At the top of the Data Source window, click Tags +.
4. Select tags from the drop-down list by clicking the box next to the tag name.
   

   Select Tags from List

5. If you do not see the tag you want, you can create one by entering the tag name in the field and clicking Create Tag.
   

   Create Tag

6. Click Save.