Schedule a report - Administrator Guide - 6.9 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.9
Creation date
2022-09-29
Last date published
2024-03-28
End_of_Life
EoL
Category
Administrator Guide
Abstract

Schedule a report in Cortex XSOAR to run at a specific time. Send reports by email, choose recipients.

You can schedule a report to run at specific times with start and end dates. You can also add restrictions on the report content and the number of recipients. If you want to send the report to users by email, you need to add an email integration instance, such as EWS, Gmail, Mail Sender, and so on.

  1. In the Reports tab, select the report you want to schedule.

  2. In the Next Run field, click Disabled or the date it was last run.

    If creating or editing a report, click next to the Schedule field.

  3. In the dialog box, add the following information:

    • The email addresses of the recipients you want to send the report to, if required.

    • Select the Scheduled checkbox.

  4. If you want to restrict the content of the report according to roles, in the Run as Roles field, from the dropdown list, select one of the roles.

    If there are roles with conflicting permissions, the highest permission level takes precedence.

    After you select a role, users with lower permissions than that role are not able to edit the report. For example, if you set Run as Roles to Administrator, Analysts do not have edit access to the report.

  5. Schedule a report according to one of the following methods:

    • Human view: Schedules a report according to the set number of hours. You can add days of the week with start and end times.

      When scheduling a report in the Human view the Next Run date may be incorrect. You may need to change the number of hours field when scheduling the report.

    • Cron view: Schedules a report according to a Cron time string format, which consists of five fields that Cron converts into a time interval. Use this view to schedule a report on certain hours, days, months, years, and so on. For examples of Cron strings, see Schedule a Report Examples.

      Note

      When using the Cron view, the Start at and Ends fields may conflict with Cron string expressions. For example, when using frequencies (i.e. ‘/’) if you type the expression 0 */6 * * * (runs every 6 hours), with a start time of 15.00, the next run time is not 21:00. The run time depends on Cron run times, which are 00.00, 06:00, 12:00, and 18:00 per day. In this example, the report runs at 15.00, 18.00, and then 00.00, etc. For examples using Cron generally, see Cron examples.

  6. Click Save.

    The schedule date appears in the Next Run field on the main Reports tab.