> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/reports/run-or-schedule-reports.md). # Run or schedule reports You can generate reports using pre-designed dashboard templates, or create custom reports from scratch with widgets from the **Widget Library**. You can also schedule your reports to run regularly or just once. All reports are saved under Dashboards & Reports → Reports. To take actions on existing report templates, go to Dashboards & Reports → Customize → Report Templates. On this page you can also import and export report templates in a JSON format, which enables you to transfer your configurations between environments for onboarding, migration, backup, and sharing. You can bulk export and import multiple report templates at a time. {% hint style="info" %} ### Note * Report templates that are based on custom infrastructure cannot be exported. * If you import a report template that already exists in the system, the imported template will overwrite the existing template. If you do not want to overwrite the existing template, duplicate and rename the existing template before importing the new template. {% endhint %}
Run a report based on a dashboard You can generate a report based on an existing dashboard. 1. Select Dashboards & Reports → Customize → **Dashboards Manager**. 2. Right-click the dashboard from which you want to generate a report, and select **Save as report template**. 3. Enter a unique name for the report and an optional description, and click **Save**. 4. Select Dashboards & Reports → Customize → **Report Templates**. 5. Locate your report and take one of the following actions: * To run the report without make any modifications, hover over the report name, and select **Generate Report**. * To modify or schedule the report, hover over the report name, and select **Edit**. 6. After your report completes, you can download it from the Dashboards & Reports → **Reports** page.
Create a new report template You can base your report on an existing template, or you can start with a blank template. 1. Select Dashboards & Reports → Customize → Reports Templates → **+ New Template**. 2. Enter a unique name for the report and an optional description. 3. Under **Data Timeframe**, select the time frame from which to run the report. Custom time frames are limited to one month. 4. Under **Report Type** select the report template on which to base the report, or select a blank template to build the report from scratch. 5. Customize your report. Cortex XDR offers mock data to help you visualize the data's appearance. To see how the report would look with real data in your environment, switch to **Real Data**. Select **Preview in A4** to see how the report is displayed in an A4 format. 6. Add or remove widgets to the report. From the widget library, drag widgets on to the report. Notes for agent-related widgets and incident-related widgets {% hint style="info" %} #### Note * For agent-related widgets, you can limit the results to only the endpoints that belong to the group by applying an endpoint scope. Select the menu on the top right corner of the widget, select **Groups**, and select one or more endpoint groups. * For incident-related widgets, you can limit your incidents to only those that match an incident starring configuration on your dashboard. A purple star indicates that the widget is displaying only starred incidents. {% endhint %} 7. (Optional) Include filters in the report.

Notice

Filters are supported only in Cortex XDR Pro and Cortex XSIAM.

For reports that include Custom XQL widgets with predefined parameters, the **FILTERS & INPUTS** option is displayed. Defining filters and inputs for the report gives you the flexibility to filter the report data based on default values that you define. Steps to configure filters and inputs: 1. Select **+ Add Filters & Inputs**. 2. On the **FILTERS & INPUTS** panel, click **+Add an input** and select one of the following options: * To specify a single predefined value, select **Single Select**. * To specify multiple predefined values, select **Multi Select**. * To specify a single free text value, select **Free text/number**. 2. Under **Parameter Title** enter a name that identifies the parameter. 3. Under **Parameter**, select the parameter that you want to configure. The parameters are extracted from the XQL queries of the widgets on the dashboard. You can define up to four parameter filters on a report or dashboard. 4. Under **Default Value**, specify a value for the selected parameters. This value overwrites any predefined default values in the XQL query.

Note

The values must support the parameter type. For example, for $name specify characters and for $num specify numbers.

5. Click **Save Filters & Inputs**. 8. When you have finished customizing your report template, click **Next**. 9. If you are ready to run the report select **Generate now**, or define options for scheduling the report. 10. (Optional) Under **Email Distribution** and **Slack workspace** add the recipients that you want to receive a PDF version of your report. * Select **Add password used to access report sent by email and Slack** to set password encryption. Password encryption is only available in PDF format. 11. (Optional) Select **Attach CSV** to attach CSV files of your XQL query widgets to the report. From the menu, select one or more of your custom widgets to attach to the report. The CSV files of the widgets are attached to the report along with the report PDF. Depending on how you selected to send the report, the CSV file is attached as follows: * Email: Sent as separate attachments for each widget. The total size of the attachment in the email cannot exceed 20 MB. * Slack: Sent within a ZIP file that includes the PDF file. 12. Click **Save Template**. 13. After your report completes, you can download it from the Dashboards & Reports → **Reports** page. In the **Name** field, icons indicate the number of attached files for each report. Reports with multiple PDF and CSV files are marked with a zip icon. Reports with a single PDF are marked with a PDF icon.
Configure the notification rule for a failed report You can receive an email alert if a report fails to run due to a timeout or fails to upload to the GCP bucket. 1. Under **Settings** → **Configurations** → **General** → **Notifications**, click **+ Add Forwarding Configuration**. 2. Enter a name and a description for your rule, and under **Log Type**, select **Management Audit Logs**. 3. Use a filter to select the **Type** as **`Reporting`**, **Subtype** as **`Run Report`**, and **Result** as **Fail**. 4. Under **Distribution List**, select the email address to send the notification to. 5. Click **Done**.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/reports/run-or-schedule-reports.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.