Skip to main content

Report Cookbook

Working code beats a blank editor. This page routes to the report scripts in the appendix and says what each one demonstrates. Read Creating a Report first for the mechanics; come here to find something close enough to adapt.

How to Use a Recipe​

Read, Then Clone​

Find the recipe closest to the question, read what it does, then use Clone on Reports → Processors — or Import Report with an exported definition — to get an editable copy rather than pasting into an empty editor.

Adapt the Selection​

What almost always has to change: index names, field names, and the time window. See Normalization for field naming.

Adapt the Arguments​

Re-point the recipe's arguments at your own defaults before scheduling it, and check that the recurrence and the window agree.

Test Before Scheduling​

Run once from the run dialog over a short window, read the output, then schedule.

Existing Recipes​

The report scripts in the appendix.

AzureAD_Logins​

Sign-in reporting over Azure AD / Entra ID authentication telemetry. Demonstrates selecting an identity-provider index and summarizing authentication outcomes. See AzureAD_Logins.

BehaviorSummary​

Reporting over the platform's own behavior-summary tickets rather than over raw telemetry. Demonstrates reporting on the SIEM's output — the natural basis for a SOC metrics report, including AI closure rates. See BehaviorSummary for the report, and SIEM → Behavior Summary for the page the tickets it counts are worked on.

EventIngress​

Volume reporting over data arriving in the platform. Demonstrates ingest accounting and is the basis for capacity and licensing reports. See EventIngress for the report, and Platform → Usage for the built-in charts covering the same ground.

LoadResources_AD​

A Task rather than a report to read: it loads Active Directory data into a resource table for other content to enrich against. Demonstrates the Task category and the resource-loading pattern. See LoadResources_AD for the task, and SIEM → Resources for the table it writes into.

Office365_UserActivityInvestigation​

A per-subject investigation report driven by a username argument. Demonstrates the on-demand, argument-driven pattern where one processor serves any user under investigation. See Office365_UserActivityInvestigation.