Focused Report

It is a scheduled report intended to facilitate/add to the monitoring process by sending a report according to the schedule that will be decided. In addition, it is possible to decide on additional rules that will be sent in a scheduled report.

Actions:

ESM

To create a focused report, select a report that you want to make a schedule for.

For example, we will choose the Audit Activity report.

This report collects information about Audit activities.

If the Entity wants to get all audit alerts in one scheduled (Focused) report and not separately by email, or if he wants to receive a report in addition to notifications, this guide will help you configure that report.

In our case, we will configure a focused report for 3 entities, Test1, Test2 and Test3.

Report Path:

/All Reports/Mobula Use Cases/Auditing/Audit Activity (Stage)

Select the desired report
Right-click, select “New Focused Report”

A new focused report will be created in the Edit tab, give it a Name [Attributes Tabs]
- Parameters tab -

The default report parameters are report format, page size, and who should receive the report by mail.

In order to change their parameters you need to uncheck the box.
Making changes in the parameter tab will influence the “Jobs” tab.

Jobs Tab - Here you can configure the schedule to send the report / format of the file / entities* (customers) / Email recipients / report times information of 24 Hours / more) etc…

In Jobs tab click on +Add

Enter a name for a job and a description (If there are few entities on the same report we usually give the name of the entity to the job)

In the lower area, you will find “Jobs Parameters.” Here, you must uncheck the boxes that you wish to change.
- Report Format - Some entities prefer their reports in PDF format or in CSV format, in Common Parameters - Report Format, Uncheck the box and select the format that you want.
- Email To - Add recipients separated with “,”
- Email Format—If you want the report attached to the mail as a file, uncheck the box and select Attach Report; otherwise, it will be shown in the mail body.
- Start Time—The time range of the rules in the report—the last 24 hours is the default. If you want to change it to a bigger time range, for example, the last 3 days, uncheck the box and change the time range.
- Customer - select the customer that you want to send this report to.

Summary - select “Click here to set up schedule frequency”

Choose the desired routine

Pay attention. Do not select the exact same “Schedule Frequency time” for several jobs. You must select at least one different mili second in every job to avoid a known bug that can cause a report not belonging to the entity to be sent to another entity.

For this example we have configured 3 different jobs to 3 different entities on a daily basis.

It looks like this:

Test 1 - Daily - 07:00:00
Test 2 - Daily - 07:00:07
Test 3 - Daily - 07:00:47

We used random hours for each job by giving random seconds in the Schedule Frequency.
Click Apply and ok
Preview - You can check the preview of a report for each job by clicking on “Preview” and selecting a customer.

Best Practices

Event Summary report - On our platform we create a Job for each entity to get last 24H alerts every morning. Path:

/All Reports/Mobula/Correlations/Events Report Summary

Audit activities Report + AuditReport stage - If there is some rule that as a soc I have nothing to do with, but the entity still wants to see its information or in case the entity doesnt want to get all the audit alerts by may but he wants to see this information in a report form we usually change that rules stage to “AuditReport” and this will add that specific rules to the “Audit Activities (Stage)” Report. Path:

/All Reports/Mobula Use Cases/Auditing/Audit Activity (Stage)

Compliance reports - There is lots of useful compliance reports that can be scheduled for a long time range to give you better insight into users in your organization for example.

/All Reports/Mobula/Compliance/AD Users/Compliance - Users that have not Logged in - make a Focused report from this report to be sent every 6 Month.

Check out what other reports can be useful to you,

/All Reports/Mobula/Compliance

Bigger report time range - If some report default is to show the last 24 Hours, and you want to send a weekly report, in “Jobs Parameters” under “Customer Parameters” uncheck the box near “Start Time” and select the time range you need from available options, or just click on “...” to select a custom date.
Report positioning - Our best practice is to move focused reports to dedicated folders so that we can display them more conveniently.