Create the notification rule for a failed report - You can receive an email notification if a report fails to run. - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide
Product
Cortex XPANSE
Version
2
Creation date
2024-12-02
Last date published
2026-05-03
Category
User Guide
Solution
SaaS
Abstract

You can receive an email notification if a report fails to run.

You can receive an email alert if a report fails to run due to a timeout or fails to upload to the GCP bucket.

  1. Under Settings → Configurations → General → Notifications, click + Add Forwarding.

  2. Enter a name and a description for your rule, and under Log Type, select Management Audit Logs.

  3. Use a filter to select the Type as Reporting, Subtype as Run Report, and Result as Fail.

  4. Under Distribution List, select the email address to send the notification to.

  5. Click Done.