Scheduled Reports
Run a saved search or dashboard on a cron schedule and produce downloadable CSV and self-contained HTML report artifacts.
Scheduled Reports
Scheduled reports run a saved search or a dashboard on a cron schedule and produce downloadable report artifacts — a daily failed-auth summary for the morning stand-up, a weekly dashboard snapshot for leadership, a monthly export for compliance.
Creating a report
Start from a search or a dashboard
- From search — open the search More (…) menu → Schedule report. Your current query is carried into the report. You can also schedule any saved query directly from the saved-queries palette.
- From a dashboard — use the dashboard viewer's overflow menu.
Configure the report
The editor opens as a right-side flyout:
| Field | Meaning |
|---|---|
| Name | How the report appears in the Reports list and in notifications |
| Source query | The nPL query (or dashboard) the report runs — editable, including when editing an existing report |
| Time window | The lookback each run covers (e.g. the last 24 hours) |
| Schedule | Cron expression controlling when runs execute |
| Runs to keep | Retention — how many past runs (and their artifacts) are kept |
| Enabled | Toggle the schedule on/off without deleting the definition |
Save and verify the first run
After the first scheduled run completes, open the report's run history and download the artifact to confirm the output is what you expect.
Artifacts
| Report source | Artifacts produced |
|---|---|
| Search | A CSV of the results plus a self-contained HTML summary |
| Dashboard | A self-contained HTML report |
Artifacts contain no external assets — everything is embedded — so they render correctly in air-gapped deployments and when forwarded outside the SOC.
Artifacts are stored and downloadable in-app. Each run records its status, row count, and truncation flags: row and size caps are enforced and flagged on the run, never silently applied — if a report was cut off, the run says so. Old runs are pruned to the report's runs to keep retention.
PDF export is not yet available. The self-contained HTML artifact is the portable format.
Notifications on completion
When a run completes you're notified through:
- The in-app bell.
- The notification spine — completion fires a
report_readyevent. Subscribe a channel to the Scheduled reports event type (see Notifications) to route report cards to Slack, Teams, or a generic webhook.
The report card's link back to the report requires the notification base URL to be set on Settings → Notifications. Without it, cards are delivered without a clickable link.
Execution identity
Report runs execute as the report owner, under the owner's access — the results reflect what that user is allowed to see, not what the person reading the artifact can see.
Because reports run without an interactive audit-view context, a report whose query targets the internal audit log (source_type=audit) returns no rows by design — a fail-closed safety limitation, not a bug. Review audit data interactively instead.
Managing reports
The Reports management surface lists all report definitions, each report's run history (status, row count, truncation), and artifact downloads for every retained run. Use the Enabled toggle to pause a schedule without losing its history.