Creating and viewing reports

This section explains how to create and view reports in RSA NetWitness. To learn how to import an existing report to RSA NetWitness, see the section about importing a preconfigured report to RSA NetWitness.

To create a new report in RSA NetWitness:

1. On the RSA NetWitness menu, select Dashboard > Reports. (In RSA NetWitness 11, you select Monitor > Reports.)

   The Manage tab is displayed.

2. Select a rule on the basis of which you will create a report (for example, CyberTrace Detect Botnet).
3. For the selected rule, click the Settings split button () and then select Create Report.
4. In the Use Rule window, select the New Report option and then click the Select button.

   

   Use Rule window

5. On the New Report tab, select the way that you want the data to be displayed.

   For the CyberTrace Detect Botnet rule, you can display data in tabular form only.

6. Click the Schedule button.

   The Schedule Report form appears.

7. In the Schedule Report form, specify the following data:
   • Schedule name.
   • Data source (database from the NetWitness Platform DB drop-down list).
   • Time when the report must be generated.
   • Period during which the data to be displayed is obtained.
   • Actions to be performed with the report (for example, to send it by email).

   

   Schedule Report form

8. Click Schedule.

Viewing a report

To view a created report:

1. On the RSA NetWitness menu, select Dashboard > Reports. (In RSA NetWitness 11, you select Monitor > Reports.)

   The Manage tab is displayed.

   

   The Manage tab

2. Click Reports.

   The Reports view is displayed.

   

   Reports view

3. In the Reports pane, pause the mouse over a report, click the Settings split button (), and select View Scheduled Reports.
4. Select your schedule report and click View.