Enabling CSV Export on Cortex XDR Reports

[chukaokonkwo]

Hi all,

Is there some configuration or third-party connector, or some service that can be used to enable exporting to CSV from Cortex XDR Reports?  Right now the only option to export a report is through a PDF which is super inconvenient.  I attached a screenshot to show what I speak of. 

[eluis]

Hi  @chukaokonkwo, 

I wonder about the reason to have the reports in csv format since the most visual and human/user friendly is a pdf to read and understand the report. 

KR,

Luis

[bbarmanroy]

Hi @chukaokonkwo This is listed in the XDR guide (Create a Report from Scratch Step 11):  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/monitoring/cortex-xdr-dashb...

Please see an example below:

1. Create a custom XQL widget (Reporting -> Widgets Library) which will provide the data you need, and save it. In my example, I am listing endpoints without EED capabilities. My end goal is to obtain the results as a CSV format.

2. Create a new Report template and click Next twice after designing your template. I have left mine as blank as an example.

3. Choose the custom XQL Query (the same widget you created in Step 1) in the drop-down menu and click Save.

4. If you chose "Generate Now" in step 3, the report will be present as a zipped file in the Reports section. If you have set a schedule, the reports will be created as per schedule.
See an example where the report results were created in CSV format for the XQL query in step 1.

[chukaokonkwo · Accepted solution]

@bbarmanroy   a million thanks to you for this awesome write-up.  I'll surely be trying it out.

[bbarmanroy]

You are welcome, @chukaokonkwo! 😁