Schedule ThreatSync Reports

Applies To: ThreatSync This topic applies to ThreatSync.

Some of the features described in this topic are only available to participants in the ThreatSync+ NDR Beta program. If a feature described in this topic is not available in your version of WatchGuard Cloud, it is a beta-only feature.

You can schedule ThreatSync reports to run for different incident types. Each scheduled report can contain multiple reports. WatchGuard Cloud sends scheduled reports as a zipped folder email attachment that contains individual .PDF reports to recipients you specify. Recently generated reports are also available for download in WatchGuard Cloud.

Manage Scheduled Reports

To view and manage scheduled reports:

1. Log in to WatchGuard Cloud.
2. Select Administration > Scheduled Reports.
   The list of scheduled reports opens.

From the Scheduled Reports page, you can add, edit, or delete scheduled reports. You can also download recently generated reports.

Add a Scheduled Report for ThreatSync

You can schedule reports to run daily, weekly, monthly, or immediately.

To add a scheduled report for ThreatSync:

1. Click Add Scheduled Report.
   The Create Schedule wizard opens with the Report Description step selected.

2. In the Schedule Name text box, type a name for the report.
3. In the Description text box, type a description for the report.
4. In the Product or Application section, select Threats.
5. Click Next.
   The Add Reports page opens.

6. In the Reports section, select the check box for each report to include in your scheduled report. To include all available reports, click Select All .
7. In the Filters section, click Select filters and select the filters to apply to your scheduled report.

The Filters section is not available if only the Executive Summary report is selected.

8. In the Sort Criteria section, select whether to sort the report by date or risk level, in ascending or descending order.
9. Click Next.
   The Schedule Report step opens.

10. From the Frequency drop-down list, select one of these options to specify how often to run the report:
    • Daily — Runs daily and contains data for the previous day for 00:00 until 23:59for the selected time zone.
    • Weekly — Runs weekly and contains data for Sunday 00:00 to Saturday 23:59for the selected time zone.
    • Monthly — Runs monthly and contains data for the first day of the month 00:00 to the last day of the month 23:59for the selected time zone.
    • Run Now — Generates the report for the date range you specify.
11. For a Weekly report, specify the day of the week to run the report.
12. For a Monthly report, specify the day of the month to run the report.
13. To select the time the report starts to run, in the Start Time text box, click .
    Or, in the Start Time text box, type the hour and minute of the day to start the report, in 24-hour format HH:MM.
14. Specify the Time Zone for the scheduled report.
15. Select the Language for the report.
16. Click Next.
    The Add Recipients step opens.

17. In the Report Recipients text box, type the email address for each report recipient. To separate multiple addresses, use a space, comma, or semicolon. Press Enter to add the specified addresses to the recipient list.
    Reports must be smaller than 10 MB to be emailed.
18. To add yourself as a recipient, click Add me as a recipient.
    The email address associated with your WatchGuard Cloud account shows in the list.
19. Click Next.
    The Finish page opens, with a summary of the scheduled report settings.
20. Click Save Report.
    The report is added to the list of scheduled reports.

Edit or Delete a Scheduled Report

You can edit and delete scheduled reports.

To edit a scheduled report:

1. In the list of scheduled reports, click the report name.
   A summary of the report settings opens.

2. To edit the report description, click Edit Description.
3. To edit the reports to run:
   1. Click Edit Reports.
   2. Select the check box for each report to include.
4. To edit the report schedule:
   1. Click Edit Schedule.
   2. From the Frequency drop-down list, select Monthly, Weekly, or Daily.
   3. Specify the day and time to start the report.
   4. Specify the Time Zone for the scheduled report.
   5. Select the Language for the report.
5. To edit the report recipients, click Edit Recipients.
6. To save your changes, click Update.

To delete a scheduled report:

1. Next to the name of the report you want to delete, click .
2. Select Delete.
3. In the Remove Scheduled Report dialog box, click Remove.
   The report is removed.

Download a Generated Scheduled Report File

When a scheduled report runs, WatchGuard Cloud sends the generated reports as a zipped .PDF email attachment to the report recipients. WatchGuard Cloud also stores all scheduled report files for a limited time, based on the report frequency:

• Monthly reports are stored for three months.
• Weekly reports are stored for three weeks.
• Daily reports are stored for three days.
• Run Now reports are stored for seven days.

If a scheduled report file is larger than 10 MB, the notification email does not include an attached report file. Instead, the report notification email instructs the recipient to log in to WatchGuard Cloud to download the scheduled report for the account.

To download a scheduled report file:

1. Log in to WatchGuard Cloud.
2. Select Administration > Scheduled Reports.
   The list of scheduled reports opens.
3. In the scheduled reports list, click the report name.
   The report settings and report history show.
4. Scroll down to the History section.

5. To download a report file, click or .

   If you do not see the report, it might still be processing. The time required to process and generate the report depends on the types of selected reports, and position of the request in the processing queue.

For each report, the History shows the date the report was run, the completion status, an expiration date, and the report file size. When the report file expires, WatchGuard deletes the file.

Related Topics

About ThreatSync Reports

Scheduled Reports