Creating and viewing reports

February 27, 2024

ID 167815

This section explains how to create and view reports in RSA NetWitness. To learn how to import an existing report to RSA NetWitness, see the section about importing a preconfigured report to RSA NetWitness.

To create a new report in RSA NetWitness:

  1. On the RSA NetWitness menu, select Dashboard > Reports. (In RSA NetWitness 11, you select Monitor > Reports.)

    The Manage tab is displayed.

  2. Select a rule on the basis of which you will create a report (for example, CyberTrace Detect Botnet).
  3. For the selected rule, click the Settings split button (Settings split button in RSA NetWitness.) and then select Create Report.
  4. In the Use Rule window, select the New Report option and then click the Select button.

    Use Rule window in RSA NetWitness.

    Use Rule window

  5. On the New Report tab, select the way that you want the data to be displayed.

    For the CyberTrace Detect Botnet rule, you can display data in tabular form only.

  6. Click the Schedule button.

    The Schedule Report form appears.

  7. In the Schedule Report form, specify the following data:
    • Schedule name.
    • Data source (database from the NetWitness Platform DB drop-down list).
    • Time when the report must be generated.
    • Period during which the data to be displayed is obtained.
    • Actions to be performed with the report (for example, to send it by email).

    Schedule Report window in RSA NetWitness.

    Schedule Report form

  8. Click Schedule.

Viewing a report

To view a created report:

  1. On the RSA NetWitness menu, select Dashboard > Reports. (In RSA NetWitness 11, you select Monitor > Reports.)

    The Manage tab is displayed.

    Reports → Manage tab in RSA NetWitness.

    The Manage tab

  2. Click Reports.

    The Reports view is displayed.

    Reports view in RSA NetWitness.

    Reports view

  3. In the Reports pane, pause the mouse over a report, click the Settings split button (Settings split button in RSA NetWitness.), and select View Scheduled Reports.
  4. Select your schedule report and click View.

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.