Create the notification rule for a failed report - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide
Product
Cortex XPANSE
Version
2
Creation date
2024-12-02
Last date published
2025-03-25
Category
User Guide
Solution
Cloud
Abstract

You can receive an email notification if a report fails to run.

You can receive an email alert if a report fails to run due to a timeout or fails to upload to the GCP bucket.

  1. Under Settings → Configurations → General → Notifications, click + Add Forwarding.

  2. Enter a name and a description for your rule, and under Log Type, select Management Audit Logs.

  3. Use a filter to select the Type as Reporting, Subtype as Run Report, and Result as Fail.

  4. Under Distribution List, select the email address to send the notification to.

  5. Click Done.