> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/dashboards-and-reports/reports/manage-reports.md).
# Manage reports
You can create and edit reports in the **Reports** tab, including adding widgets, scheduling times, setting incident time range, adding recipients, and changing the format and size. Reports support PDF and CSV.
**Report actions**
You can do the following with reports.
| Report action | Description |
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Create or edit a report | When creating a report, what you see is what you get. How you configure the report is how it generates. You can add widgets to a report, change the format and paper size, and insert page breaks by adding the Page Break widget. If you have a table widget that contains many rows, you can select the number of rows on each page or print the whole table (in the table widget, right click and select Force Print full Chart).
You can add your own logo by going to Settings & Info → Settings → System → Server Settings → Logo Configuration and uploading your logo in the Full-size logo field. Reports are generated in PDF or CSV formats.
|
| Create a report from a dashboard | You can create a report from the dashboard as is, or add new widgets as required. You have the same functionality as custom reports, such as format, when to run, and orientation. To create a report from the dashboard, on the **Dashboards** page click  and select **Create report**. |
| Schedule a report | You can schedule a report to run specific times, or run the report immediately. You can also send the report to specific recipients, and restrict the report according to roles. |
| Generate an out-of-the-box report | Cortex XSOAR comes with out-of-the-box reports, such as critical and high incidents, daily incidents, and last 7 days incidents. You can change the time range for the incidents, the scheduled time and who can receive the report. If you want to make more comprehensive changes to out-of-the-box reports, copy or download (and then upload) the report. |
| Schedule a report from an incident | Captures investigation-specific data and shares it with team members. You can customize how the information is displayed for existing incidents. |
Create a report
1. In the **Dashboards & Reports** page **Reports** tab, select **New Report**.
2. Enter a name for the report.
3. Add a widget to the report.
1. Click 
to add a custom widget or select an existing widget from the **Widgets Library**.
2. To edit the widget in the report, select  then **Edit widget**.
The edits to the widget in the report apply only for the report. If you want to make changes that are available for other users, dashboards, or reports, edit the widget directly in the **Widgets Library** by clicking the pencil edit icon.
3. To add a new widget from the **Widgets Library**, follow the procedure in [Create a widget using the widget builder](/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md).
4. Click **Save**.
4. Define the report settings.
| Report setting | Description |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Date Range** | The Date Range for the report. Default is Last 7 days.
By default, a widget in a report inherits the date range that you specify when creating the report. If the date range for the report does not include the widget date range, the data is blank. To change the widget’s date range, click 
and select Use widget’s date range or Use dashboard’s date range. By default, the dashboard’s date range is used and the option in the dropdown shows as Use widget’s date range. If you change this to use the widget’s date range, the dropdown then shows the option to Use dashboard’s date range.
Note
Each widget can have its own date range, which can be different from the report’s date range.
You can schedule a report to run at specific times with start and end dates. You can also add restrictions on the report content and the number of recipients.
If you want to send the report to users by email, you need to add an email integration instance, such as EWS, Gmail, or Mail Sender. Default is Disabled.
To schedule a report:
1. Under the Schedule field, click Disabled or the date it was last run.
2. In the dialog box, add the following information:
- A comma-separated email list of report recipients.
- Select the Scheduled checkbox.
3. If you want to restrict the content of the report according to roles, in the Run as Roles field, from the dropdown list, select one of the roles.
4. Schedule a report according to one of the following methods:
Human view: Schedules a report according to the set number of hours. You can add days of the week with start and end times.
When scheduling a report in the Human view the Next Run date may be incorrect. You may need to change the number of hours field when scheduling the report.
Cron view: Schedules a report according to a Cron time string format, which consists of five fields that Cron converts into a time interval. Use this view to schedule a report on certain hours, days, months, years, and so on. For examples of Cron strings, see Report scheduling examples.
Note
When using the Cron view, the Start at and Ends fields may conflict with Cron string expressions. For example, when using frequencies (i.e. ‘/’) if you type the expression 0 \*/6 \* \* \* (runs every 6 hours), with a start time of 15.00, the next run time is not 21:00. The run time depends on Cron run times, which are 00.00, 06:00, 12:00, and 18:00 per day. In this example, the report runs at 15.00, 18.00, and then 00.00, etc. For examples using Cron generally, see Cron examples.
5. Select the Start at date and time.
6. Select the Ends condition. Options are:
- Never (default)
- by (specify the date)
- after (specify the date)
7. Select Run Now to run the report immediately. If you click Save, the report appears in the main Reports tab with the scheduled run date in the Next Run field.
|
| **Recipients** | A comma-separated email list of report recipients. Default is None.
If you want to send the report to users by email, you need to add an email integration instance, such as EWS, Gmail, or Mail Sender.
|
| **Format** | The report file format. Options are PDF (default) or CSV.
Note
Only tables and text based widgets are exported in CSV. Other widgets are ignored.
Sets the report display orientation. Options are Portrait (default) or Landscape.
Tip
We recommend using landscape orientation to ensure that all information displays in the report.
Sets the report paper size. Options are:
|
5. **Save** the report. If you select **Save Version**, you can view a history of the changes made to your report, and you can revert to previous versions.
Edit a report
1. On the **Dashboards & Reports** page **Reports** tab, select the **Duplicate Report** icon for the report you want to edit.
2. Enter a name for the report.
3. Add a widget to the report.
1. Click to add a custom widget or select an existing widget from the **Widgets Library**.
2. To edit the widget in the report, select  then **Edit widget**.
The edits to the widget in the report apply only for the report. If you want to make changes that are available for other users, dashboards, or reports, edit the widget directly in the **Widgets Library** by clicking the pencil edit icon.
3. To add a new widget from the **Widgets Library**, follow the procedure in [Create a widget using the widget builder](/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md).
4. Click **Save**.
4. Define the report settings.
| Report setting | Description |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Date Range** | The Date Range for the report. Default is Last 7 days.
By default, a widget in a report inherits the date range that you specify when creating the report. If the date range for the report does not include the widget date range, the data is blank. To change the widget’s date range, click and select Use widget’s date range or Use dashboard’s date range. By default, the dashboard’s date range is used and the option in the dropdown shows as Use widget’s date range. If you change this to use the widget’s date range, the dropdown then shows the option to Use dashboard’s date range.
Note
Each widget can have its own date range, which can be different from the report’s date range.
You can schedule a report to run at specific times with start and end dates. You can also add restrictions on the report content and the number of recipients.
If you want to send the report to users by email, you need to add an email integration instance, such as EWS, Gmail, or Mail Sender. Default is Disabled.
To schedule a report:
1. Under the Schedule field, click Disabled or the date it was last run.
2. In the dialog box, add the following information:
- A comma-separated email list of report recipients.
- Select the Scheduled checkbox.
3. If you want to restrict the content of the report according to roles, in the Run as Roles field, from the dropdown list, select one of the roles.
4. Schedule a report according to one of the following methods:
Human view: Schedules a report according to the set number of hours. You can add days of the week with start and end times.
When scheduling a report in the Human view the Next Run date may be incorrect. You may need to change the number of hours field when scheduling the report.
Cron view: Schedules a report according to a Cron time string format, which consists of five fields that Cron converts into a time interval. Use this view to schedule a report on certain hours, days, months, years, and so on. For examples of Cron strings, see Report scheduling examples.
Note
When using the Cron view, the Start at and Ends fields may conflict with Cron string expressions. For example, when using frequencies (i.e. ‘/’) if you type the expression 0 \*/6 \* \* \* (runs every 6 hours), with a start time of 15.00, the next run time is not 21:00. The run time depends on Cron run times, which are 00.00, 06:00, 12:00, and 18:00 per day. In this example, the report runs at 15.00, 18.00, and then 00.00, etc. For examples using Cron generally, see Cron examples.
5. Select the Start at date and time.
6. Select the Ends condition. Options are:
- Never (default)
- by (specify the date)
- after (specify the date)
7. Select Run Now to run the report immediately. If you click Save, the report appears in the main Reports tab with the scheduled run date in the Next Run field.
|
| **Recipients** | A comma-separated email list of report recipients. Default is None.
If you want to send the report to users by email, you need to add an email integration instance, such as EWS, Gmail, or Mail Sender.
|
| **Format** | The report file format. Options are PDF (default) or CSV.
Note
Only tables and text based widgets are exported in CSV. Other widgets are ignored.
Sets the report display orientation. Options are Portrait (default) or Landscape.
Tip
We recommend using landscape orientation to ensure that all information displays in the report.
Sets the report paper size. Options are:
|
5. **Save** the report. If you select **Save Version**, you can view a history of the changes made to your report and you can revert to previous versions.
Generate a report
To generate a report immediately:
1. In the **Reports** tab, edit the report settings as relevant, including:
* **Date Range**
* **Recipients**
* **Next Run**
2. Click **Run**.
3. Click  to download the report.
{% hint style="info" %}
### Tip
Ensure that you enable pop-ups in your browser. If reports do not download after you click **Run**, add the Cortex XSOAR URL to your browser's pop-up blocker exceptions. For more information, see [Troubleshoot script timeout for reports](/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-script-timeout-for-reports.md).
{% endhint %}
### **Report scheduling examples**
The following examples describe how to schedule a report using the Cron scheduler format. The Cron time string format consists of five fields that Cron converts into a time interval. For example, a Cron string of **`0 10 15 * *`** runs a report on the 15th of each month at 10:00 am.
Schedule a report starting January 1 and then monthly
In this example, you want to schedule a report on January 1, 2020 at 0800 (8:00 am) and thereafter on the 1st of each month.
In the **Cron Expression** field, type **`00 8 1 1/1 *`**
| Number | Description |
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 00 | 00 in minutes |
| 8 | 8am |
| 1 | The first of each month |
| 1/1 | Starting in January, and every month thereafter. If you want the report to start on a different month, change 1/1 to the relevant month, such as 2/1 for February, 3/1 for March and so on. |
| \* | Any day of the week |
The reports run at 8am on January 1, 2020, February 1, 2020, March 1, 2020 and so on.
{% hint style="info" %}
### Note
Cron calculates the next relevant date. If you want the report to run next month, provided that date has passed in the current month, you do not need to specify the month. For example, assume the date is December 12. To run the report on January 11 at 8:00 am, type **00 8 11 \* \***. The report starts running on January 11 (and on 11th of each month thereafter). If the current date is December 10, the next run date would be December 11.
{% endhint %}
Schedule a report for once a year
In this example you want to schedule a report on January 6, 2020 at 0800 (8:00 am) and every year on January 1 (the current date is Thursday 12 December 2019).
In the **Cron Expression** field, type **`00 8 1 1 *`**
| Number | Description |
| ------ | -------------------------------------------------------------- |
| 00 | 00 minutes |
| 8 | 8am |
| 1 | 1st day of each month |
| 1 | Starting every January. For different months change the number |
| \* | Any day of the week |
The report runs at 0800 on January 1, 2020, January 1, 2021, January 1, 2022, etc.
Schedule a report every week on a Monday
In this example, you need to schedule a report at midnight every week on a Monday (the current date is Thursday, 12 December 2019)
Type the following expression in Cron: **`00 0 * * 1`**
| Number | Description |
| ------ | ------------- |
| 00 | 00 in minutes |
| 0 | Midnight |
| \* | Any day |
| \* | Any month |
| 1 | Monday |
The report runs on the first available Monday December 16 at midnight, and on December 23, December 30, January 6, etc.
Schedule a report every weekday from February for 6 months
In this example, you need to schedule a report at 1730 (5:30 pm) every weekday (Monday - Friday) starting in February for 6 months (assume the current date is Thursday December 12, 2019).
In the **Cron Expression** field, type **`30 17 * 2/6 1-5`**
| Number | Description |
| ------ | ------------------------------------------- |
| 30 | 30 minutes |
| 17 | 5pm |
| \* | Any day |
| 2/6 | Starting in February for the next 6 months. |
| 1-5 | Monday to Friday |
The report runs at 1730 (5:30 pm) on February 3, 4, 5, 6, 7, etc.
Schedule a daily report
In this example, you need to schedule a report every day at 0600 (6:00 am) (the current date is Wednesday 12 December).
In the **Cron Expression** field, type **`0 6 * * *`**
| Number | Description |
| ------ | ---------------------------------------------------------------------------------------------------------- |
| 00 | 00 in minutes |
| 6 | 6am |
| \* | Any day |
| \* | Any month |
| \* | Any day of the week. If you want to run from Monday to Friday, type 1-5. For Sunday to Thursday, type 0-4. |
The report runs at 0600 (6:00 am) on December 13, 14, 15, 16 and so on.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/dashboards-and-reports/reports/manage-reports.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.