Schedule a report in Cortex XSOAR to run at a specific time. Send reports by email, choose recipients.
You can schedule a report to run at specific times with start and end dates. You can also add restrictions on the report content and the number of recipients. If you want to send the report to users by email, you need to add an email integration instance, such as EWS, Gmail, Mail Sender, etc.
In the Reports tab, find the report you want to schedule.
In the Next Run field, click Disabled or the date it was last run.
If creating or editing a report, click under the Schedule field.
In the dialog box, add the following information:
The email addresses of the recipients you want to send the report to, if required.
Select the Scheduled checkbox.
If you want to restrict the content of the report according to roles, in the Run as Roles field, from the dropdown list, select one of the roles.
Schedule a report according to one of the following methods:
Human view: Schedules a report according to the set number of hours. You can add days of the week with start and end times.
When scheduling a report in the Human view the Next Run date may be incorrect. You may need to change the number of hours field when scheduling the report.
Cron view: Schedules a report according to a Cron time string format, which consists of five fields that Cron converts into a time interval. Use this view to schedule a report on certain hours, days, months, years, and so on. For examples of Cron strings, see Schedule a Report Examples.
When using the Cron view, the Start at and Ends fields may conflict with Cron string expressions. For example, when using frequencies (i.e. ‘/’) if you type the expression
0 */6 * * *(runs every 6 hours), with a start time of 15.00, the next run time is not 21:00. The run time depends on Cron run times, which are 00.00, 06:00, 12:00, and 18:00 per day. In this example, the report runs at 15.00, 18.00, and then 00.00, etc. For examples using Cron generally, see Cron examples.
The schedule date appears in the Next Run field on the main Reports tab.