Reports

This section describes how to use reports, manage custom report templates, use report templates to generate new reports, and create report delivery tasks.

Using reports

The Reports feature allows you to get detailed numerical information about the security of your organization's network, save this information to a file, send it by email, and print it.

Reports are available in the Kaspersky Security Center Cloud Console, in the Monitoring & reporting section, by clicking Reports.

By default, reports include information for the last 30 days.

Kaspersky Security Center Cloud Console has a default set of reports for the following categories:

• Protection status
• Deployment
• Updating
• Threat statistics
• Other

You can create custom report templates, edit report templates, and delete them.

You can create reports that are based on existing templates, export reports to files, and create tasks for report delivery.

Creating a report template

To create a report template:

1. In the main menu, go to Monitoring & reporting → Reports.
2. Click Add.

   The New report template wizard starts. Proceed through the wizard by using the Next button.

3. Enter the report name and select the report type.
4. On the Scope step of the wizard, select the set of client devices (administration group, device selection, selected devices, or all networked devices) whose data will be displayed in reports that are based on this report template.
5. On the Reporting period step of the wizard, specify the report period. Available values are as follows:
   • Between the two specified dates
   • From the specified date to the report creation date
   • From the report creation date, minus the specified number of days, to the report creation date

   This page may not appear for some reports.

6. Click OK to close the wizard.
7. Do one of the following:
   • Click the Save and run button to save the new report template and to run a report based on it.

     The report template is saved. The report is generated.

   • Click the Save button to save the new report template.

     The report template is saved.

You can use the new template for generating and viewing reports.

Viewing and editing report template properties

Expand all | Collapse all

You can view and edit basic properties of a report template, for example, the report template name or the fields displayed in the report.

To view and edit properties of a report template:

1. In the main menu, go to Monitoring & reporting → Reports.
2. Select the check box next to the report template whose properties you want to view and edit.

   As an alternative, you can first generate the report, and then click the Edit button.

3. Click the Open report template properties button.

   The Editing report <Report name> window opens with the General tab selected.

4. Edit the report template properties:
   • General tab:
     • Report template name
     • Maximum number of entries to display

       If this option is enabled, the number of entries displayed in the table with detailed report data does not exceed the specified value. Note that this option does not affect the maximum number of events that you can include in the report when you export the report to a file.

       Report entries are first sorted according to the rules specified in the Fields → Details fields section of the report template properties, and then only the first of the resulting entries are kept. The heading of the table with detailed report data shows the displayed number of entries and the total available number of entries that match other report template settings.

       If this option is disabled, the table with detailed report data displays all available entries. We do not recommend that you disable this option. Limiting the number of displayed report entries reduces the load on the database management system (DBMS) and reduces the time required for generating and exporting the report. Some of the reports contain too many entries. If this is the case, you may find it difficult to read and analyze them all. Also, your device may run out of memory while generating such a report and, consequently, you will not be able to view the report.

       By default, this option is enabled. The default value is 1000.

       Note that the Kaspersky Security Center Cloud Console interface can display a maximum of 2500 entries. If you need to view a greater number of events, use the report export feature.

     • Group

       Click the Settings button to change the set of client devices for which the report is created. For some types of the reports, the button may be unavailable. The actual settings depend on the settings specified during creation of the report template.

     • Time interval

       Click the Settings button to modify the report period. For some types of the reports, the button may be unavailable. Available values are as follows:

       • Between the two specified dates
       • From the specified date to the report creation date
       • From the report creation date, minus the specified number of days, to the report creation date
     • Include data from secondary and virtual Administration Servers

       If this option is enabled, the report includes the information from the secondary and virtual Administration Servers that are subordinate to the Administration Server for which the report template is created.

       Disable this option if you want to view data only from the current Administration Server.

       By default, this option is enabled.

     • Up to nesting level

       The report includes data from secondary and virtual Administration Servers that are located under the current Administration Server on a nesting level that is less than or equal to the specified value.

       The default value is 1. You may want to change this value if you have to retrieve information from secondary Administration Servers located at lower levels in the tree.

     • Data wait interval (min)

       Before generating the report, the Administration Server for which the report template is created waits for data from secondary Administration Servers during the specified number of minutes. If no data is received from a secondary Administration Server at the end of this period, the report runs anyway. Instead of the actual data, the report shows data taken from the cache (if the Cache data from secondary Administration Servers option is enabled), or N/A (not available) otherwise.

       The default value is 5 (minutes).

     • Cache data from secondary Administration Servers

       Secondary Administration Servers regularly transfer data to the Administration Server for which the report template is created. There, the transferred data is stored in the cache.

       If the current Administration Server cannot receive data from a secondary Administration Server while generating the report, the report shows data taken from the cache. The date when the data was transferred to the cache is also displayed.

       Enabling this option allows you to view the information from secondary Administration Servers even if the up-to-date data cannot be retrieved. However, the displayed data can be obsolete.

       By default, this option is disabled.

     • Cache update frequency (h)

       Secondary Administration Servers at regular intervals transfer data to the Administration Server for which the report template is created. You can specify this period in hours. If you specify 0 hours, data is transferred only when the report is generated.

       The default value is 0.

     • Transfer detailed information from secondary Administration Servers

       In the generated report, the table with detailed report data includes data from secondary Administration Servers of the Administration Server for which the report template is created.

       Enabling this option slows the report generation and increases traffic between Administration Servers. However, you can view all data in one report.

       Instead of enabling this option, you may want to analyze detailed report data to detect a faulty secondary Administration Server, and then generate the same report only for that faulty Administration Server.

       By default, this option is disabled.

   • Fields tab

     Select the fields that will be displayed in the report, and use the Move up button and Move down button to change the order of these fields. Use the Add button or Edit button to specify whether the information in the report must be sorted and filtered by each of the fields.

     In the Filters of Details fields section, you can also click the Convert filters button to start using the extended filtering format. This format enables you to combine filtering conditions specified in various fields by using the logical OR operation. After you click the button, the Convert filters panel opens on the right. Click the Convert filters button to confirm conversion. You can now define a converted filter with conditions from the Details fields section that are applied by using the logical OR operation.

     Conversion of a report to the format supporting complex filtering conditions will make the report incompatible with the previous versions of Kaspersky Security Center (11 and earlier). Also, the converted report will not contain any data from secondary Administration Servers running such incompatible versions.

5. Click Save to save the changes.
6. Close the Editing report <Report name> window.

The updated report template appears in the list of report templates.

Exporting a report to a file

You can save one or multiple reports as XML, HTML, or as a PDF. Kaspersky Security Center Cloud Console allows you to export up to 10 reports to files of the specified format at the same time.

To export a report to a file:

1. In the main menu, go to Monitoring & reporting → Reports.
2. Choose the reports that you want to export.

   If you choose more than 10 reports, the Export report button will be disabled.

3. Click the Export report button.
4. In the opened window, specify the following export parameters:
   • File name.

     If you select one report to export, specify the report file name.

     If you select more than one report, the report file names will coincide with the name of the selected report templates.

   • Maximum number of entries.

     Specify the maximum number of entries included in the report file. The default value is 10,000.

   • File format.

     Select the report file format: XML, HTML, or PDF. If you export multiple reports, all selected reports are saved in the specified format as separate files.

5. Click the Export report button.

The report is saved to a file in the specified format.

Generating and viewing a report

To create and view a report:

1. In the main menu, go to Monitoring & reporting → Reports.
2. Click the name of the report template that you want to use to create a report.

A report using the selected template is generated and displayed.

Report data is displayed only in English, other localizations are not available.

The report displays the following data:

• On the Summary tab:
  • The name and type of report, a brief description and the reporting period, as well as information about the group of devices for which the report is generated.
  • Graph chart showing the most representative report data.
  • Consolidated table with calculated report indicators.
• On the Details tab, a table with detailed report data is displayed.

Creating a report delivery task

Expand all | Collapse all

You can create a task that will deliver selected reports.

To create a report delivery task:

1. In the main menu, go to Monitoring & reporting → Reports.
2. Select the check boxes next to the report templates for which you want to create a report delivery task.
3. Click the Create delivery task button.

   The New task wizard starts. Proceed through the wizard by using the Next button.

4. At the New task settings step of the wizard, enter the task name.

   The default name is Deliver reports. If a task with this name already exists, a sequence number (<N>) is added to the task name.

5. At the Report configuration step of the wizard, specify the following settings:
   1. Report templates to be delivered by the task.
   2. The report format: HTML, XLS, or PDF.

      The wkhtmltopdf tool is required to convert a report to PDF. When you select the PDF option, Administration Server checks whether the wkhtmltopdf tool is installed on the device. If the tool is not installed, the application displays a message about the necessity to install the tool on the Administration Server device. Install the tool manually, and then proceed to the next step.

   3. Whether the reports are to be sent by email, together with email notification settings.

      You can specify up to 20 email addresses. To separate email addresses, press Enter. You can also paste a comma-separated list of email addresses, and then press Enter.

6. At the Configure task schedule step of the wizard, select the task start schedule.

   The following task schedule options are available:

   • Manually

     The task does not run automatically. You can only start it manually.

     By default, this option is selected.

   • Every N minutes

     The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.

     By default, the task runs every 30 minutes, starting from the current system time.

   • Every N hours

     The task runs regularly, with the specified interval in hours, starting from the specified date and time.

     By default, the task runs every 6 hours, starting from the current system date and time.

   • Every N days

     The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.

     By default, the task runs every day, starting from the current system date and time.

   • Every N weeks

     The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.

     By default, the task runs every Monday at the current system time.

   • Monthly

     The task runs regularly, on the specified day of the month, at the specified time.

     In months that lack the specified day, the task runs on the last day.

     By default, the task runs on the first day of each month, at the current system time.

   • On specified days

     The task runs regularly, on the specified days of each month, at the specified time.

     By default, no days of month are selected. The default start time is 18:00.

   • On virus outbreak

     The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:

     • Anti-virus for workstations and file servers
     • Anti-virus for perimeter defense
     • Anti-virus for mail systems

     By default, all application types are selected.

     You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.

   • On completing another task

     The current task starts after another task completes. This parameter only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.

     You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).

     If necessary, you can search, sort, and filter the tasks in the table as follows:

     • Enter the task name in the search field, to search the task by its name.
     • Click the sort icon to sort the tasks by name.

       By default, the tasks are sorted in alphabetical ascending order.

     • Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
7. At this step of the wizard, configure other task schedule settings:
   • In the Task schedule section, check or reconfigure the previously selected schedule and set the time interval, days of the month or week, set the virus outbreak condition or completing another task as a trigger to start the task. A start time can also be specified in this section if an applicable schedule is selected.
   • In the Additional settings section, specify the following settings:
     • Run missed tasks

       This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.

       If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.

       If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.

       By default, this option is disabled.

     • Use automatically randomized delay for task starts

       If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

       The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.

       If this option is disabled, the task starts on client devices according to the schedule.

     • Use automatically randomized delay for task starts within an interval of

       If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

       If this option is disabled, the task starts on client devices according to the schedule.

       By default, this option is disabled. The default time interval is one minute.

     • Stop the task if it runs longer than

       After the specified time period expires, the task is stopped automatically, whether it is completed or not.

       Enable this option if you want to interrupt (or stop) tasks that take too long to execute.

       By default, this option is disabled. The default task execution time is 120 minutes.

8. At the Selecting an account to run the task step of the wizard, specify the credentials of the user account that is used to run the task.
9. If you want to modify other task settings after the task is created, at the Finish task creation step of the wizard, enable the Open task details when creation is complete option (by default, this option is enabled).
10. Click the Finish button to create the task and close the wizard.

    The report delivery task is created. If the Open task details when creation is complete option is enabled, the task settings window opens.

Deleting report templates

To delete one or several report templates:

1. In the main menu, go to Monitoring & reporting → Reports.
2. Select check boxes next to the report templates that you want to delete.
3. Click the Delete button.
4. In the window that opens, click OK to confirm your selection.

The selected report templates are deleted. If these report templates were included in the report delivery tasks, they are also removed from the tasks.