topic Re: Enabling CSV Export on Cortex XDR Reports in Cortex XDR Discussions

Enabling CSV Export on Cortex XDR Reports

chukaokonkwo — Tue, 15 Feb 2022 13:54:11 GMT

Hi all,

Is there some configuration or third-party connector, or some service that can be used to enable exporting to CSV from Cortex XDR Reports? Right now the only option to export a report is through a PDF which is super inconvenient. I attached a screenshot to show what I speak of.

Re: Enabling CSV Export on Cortex XDR Reports

eluis — Tue, 15 Feb 2022 23:01:58 GMT

Hi @chukaokonkwo,

I wonder about the reason to have the reports in csv format since the most visual and human/user friendly is a pdf to read and understand the report.

KR,

Luis

Re: Enabling CSV Export on Cortex XDR Reports

bbarmanroy — Wed, 16 Feb 2022 02:42:41 GMT

Hi @chukaokonkwo This is listed in the XDR guide (Create a Report from Scratch Step 11): https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/monitoring/cortex-xdr-dashboard/run-or-schedule-reports.html

Please see an example below:

1. Create a custom XQL widget (Reporting -> Widgets Library) which will provide the data you need, and save it. In my example, I am listing endpoints without EED capabilities. My end goal is to obtain the results as a CSV format.

2. Create a new Report template and click Next twice after designing your template. I have left mine as blank as an example.

3. Choose the custom XQL Query (the same widget you created in Step 1) in the drop-down menu and click Save.

4. If you chose "Generate Now" in step 3, the report will be present as a zipped file in the Reports section. If you have set a schedule, the reports will be created as per schedule.
See an example where the report results were created in CSV format for the XQL query in step 1.

Re: Enabling CSV Export on Cortex XDR Reports

chukaokonkwo — Mon, 28 Feb 2022 22:08:52 GMT

@bbarmanroy a million thanks to you for this awesome write-up. I'll surely be trying it out.

Re: Enabling CSV Export on Cortex XDR Reports

bbarmanroy — Tue, 01 Mar 2022 02:35:11 GMT

You are welcome, @chukaokonkwo! 😁