Schedule ThreatSync+ Reports

Applies To: ThreatSync+ NDR This topic applies to ThreatSync+ NDR.

You can schedule both Service Provider and Subscriber ThreatSync+ NDR reports to run in WatchGuard Cloud. Each scheduled report can contain multiple reports. WatchGuard Cloud sends scheduled reports as a zipped folder email attachment that contains individual .PDF reports to recipients you specify. Recently generated reports are also available for download in WatchGuard Cloud.

Manage Scheduled Reports

To view and manage scheduled reports:

1. Log in to WatchGuard Cloud.
2. Select Administration > Scheduled Reports.
   The list of scheduled reports opens.

From the Scheduled Reports page, you can add, edit, or delete scheduled reports. You can also download recently generated reports.

Add a Scheduled Report for ThreatSync+ NDR (Service Providers)

You can schedule reports to run daily, weekly, monthly, or immediately for your managed accounts.

To add a scheduled Service Provider report for ThreatSync+ NDR:

1. Click Add Scheduled Report.
   The Create Schedule wizard opens with the Report Description step selected.

2. In the Schedule Name text box, type a name for the report.
3. In the Description text box, type a description for the report.
4. Click Next.
   The Add Reports page opens.

5. In the Reports section, select the Service Provider Summary Report.
6. In the Account Groups section, select which account groups to include in your scheduled report. To include all account groups, select All.

Only Subscriber accounts with a ThreatSync+ NDR license show in the Account Group list.

7. Click Next.
   The Schedule Report step opens.

8. From the Frequency drop-down list, select one of these options to specify how often to run the report:
   • Daily — Runs daily and contains data for the previous day for 00:00 until 23:59 (UTC).
   • Weekly — Runs weekly and contains data for Sunday 00:00 to Saturday 23:59 (UTC).
   • Monthly — Runs monthly and contains data for the first day of the month 00:00 to the last day of the month 23:59 (UTC).
   • Run Now — Generates the report for the date range you specify.
9. For a Weekly report, specify the day of the week to run the report.
10. For a Monthly report, specify the day of the month to run the report.
11. To select the time the report starts to run, in the Start Time text box, click .
    Or, in the Start Time text box, type the hour and minute of the day to start the report, in 24-hour format HH:MM.
12. Click Next.
    The Add Recipients step opens.

13. In the Report Recipients text box, type the email address for each report recipient. To separate multiple addresses, use a space, comma, or semicolon. Press Enter to add the specified addresses to the recipient list.
    Reports must be smaller than 10 MB to be emailed.
14. To add yourself as a recipient, click Add me as a recipient.
    The email address associated with your WatchGuard Cloud account shows in the list.
15. Click Next.
    The Finish page opens, with a summary of the scheduled report settings.
16. Click Save Report.
    The report is added to the list of scheduled reports.

The time required to generate and send the report depends on the types of selected reports, and position of the request in the processing queue.

Add a Scheduled Report for ThreatSync+ NDR (Subscribers)

You can schedule reports to run daily, weekly, monthly, or immediately.

To add a scheduled report for ThreatSync+ NDR:

1. Click Add Scheduled Report.
   The Create Schedule wizard opens with the Report Description step selected.

2. In the Schedule Name text box, type a name for the report.
3. In the Description text box, type a description for the report.
4. In the Product or Application section, select ThreatSync+.
5. Click Next.
   The Add Reports page opens.

Available ThreatSync+ reports depend on your license type. The Executive Summary and Ransomware Prevention Defense Goal reports are included by default with a ThreatSync+ NDR license. To add more reports, plus the ability to generate custom reports, we recommend you add a WatchGuard Compliance Reporting license. For more information, go to About WatchGuard Compliance Reporting.

6. In the Reports section, select the check box for each report to include in your scheduled report. To include all available reports, click Select All .

7. Click Next.
   The Schedule Report step opens.

8. From the Frequency drop-down list, select one of these options to specify how often to run the report:
   • Daily — Runs daily and contains data for the previous day for 00:00 until 23:59(UTC).
   • Weekly — Runs weekly and contains data for Sunday 00:00 to Saturday 23:59(UTC).
   • Monthly — Runs monthly and contains data for the first day of the month 00:00 to the last day of the month 23:59(UTC).
   • Run Now — Generates the report for the date range you specify.
9. For a Weekly report, specify the day of the week to run the report.
10. For a Monthly report, specify the day of the month to run the report.
11. To select the time the report starts to run, in the Start Time text box, click .
    Or, in the Start Time text box, type the hour and minute of the day to start the report, in 24-hour format HH:MM.
12. Click Next.
    The Add Recipients step opens.

13. In the Report Recipients text box, type the email address for each report recipient. To separate multiple addresses, use a space, comma, or semicolon. Press Enter to add the specified addresses to the recipient list.
    Reports must be smaller than 10 MB to be emailed.
14. To add yourself as a recipient, click Add me as a recipient.
    The email address associated with your WatchGuard Cloud account shows in the list.
15. Click Next.
    The Finish page opens, with a summary of the scheduled report settings.
16. Click Save Report.
    The report is added to the list of scheduled reports.

Edit or Delete a Scheduled Report

You can edit and delete scheduled reports.

To edit a scheduled report:

1. In the list of scheduled reports, click the report name.
   A summary of the report settings opens.

2. To edit the report description, click Edit Description.
3. To edit the reports to run:
   1. Click Edit Reports.
   2. Select the check box for each report to include.
4. To edit the report schedule:
   1. Click Edit Schedule.
   2. From the Frequency drop-down list, select Monthly, Weekly, or Daily.
   3. Specify the day and time to start the report.
5. To save your changes, click Update.

To delete a scheduled report:

1. Next to the name of the report you want to delete, click .
2. Select Delete.
3. In the Remove Scheduled Report dialog box, click Remove.
   The report is removed.

Download a Generated Scheduled Report File

When a scheduled report runs, WatchGuard Cloud sends the generated reports as a zipped .PDF email attachment to the report recipients. WatchGuard Cloud also stores all scheduled report files for a limited time, based on the report frequency:

• Monthly reports are stored for three months.
• Weekly reports are stored for three weeks.
• Daily reports are stored for three days.
• Run Now reports are stored for seven days.

If a scheduled report file is larger than 10 MB, the notification email does not include an attached report file. Instead, the report notification email instructs the recipient to log in to WatchGuard Cloud to download the scheduled report for the account.

To download a scheduled report file:

1. Log in to WatchGuard Cloud.
2. Select Administration > Scheduled Reports.
   The list of scheduled reports opens.
3. In the scheduled reports list, click the report name.
   The report settings and report history show.
4. Scroll down to the History section.

5. To download a report file, click or .

   If you do not see the report, it might still be processing. The time required to process and generate the report depends on the types of selected reports, and position of the request in the processing queue.

For each report, the History shows the date the report was run, the completion status, an expiration date, and the report file size. When the report file expires, WatchGuard deletes the file.

Related Topics

ThreatSync+ NDR Reports

ThreatSync+ SaaS Reports

Scheduled Reports