Reporting in Cortex XDR Pro on more pages

[RFeyertag]

Hello dear community, 

my supervisor needs a monthly report about still vulnerable agents. 

I got allready an XQL, which I used for the dashboard. 

config timeframe between "-1y" and "+5d"
|dataset = host_inventory
| arrayexpand kbs
| alter kbnr = json_extract(kbs , "$.name"), install_date = json_extract(kbs , "$.installation_date")
| fields host_name, kbnr , install_date, agent_domain
| alter install_date = parse_timestamp("\"%Y-%m-%d\"", install_date)
| dedup host_name, agent_domain by desc install_date
| sort asc install_date

I get more than 300 entries, and this is OK, because it needs to be flexible. The best case would be to send it *.XLSX format instead in PDF. But I would also live with the PDF format, because I can sort by the install date. 

What makes me confused is, I cannot extend the PDF to more than one A4 format page. How do I put in this report more pages?

BR

Rob

[anlynch]

Hey @RFeyertag,

I just want to make sure i'm understanding correctly.  Did you save this query and are referencing exporting the results as a report?  XQL queries typically export as .TSV files.

[RFeyertag]

Hello @anlynch , 

no, in my case I got a widget, which is send automaticly via mail to any mail I like to. 

If there is a possibility to send xql results on another way, else Reports, please let me know. 

I thought also on API to get this informations?

BR

Rob

BR

Rob

[timurphy · Accepted solution]

Hi @RFeyertag,

If you have the query saved as a widget, you can configure the report to attach the raw data from the query as a CSV. To configure this, navigate to Dashboards & Reports > Report Templates, edit the desired report template, and progress to step 3. Here you can select the appropriate widget(s) which will be sent as CSV files alongside the PDF for the report:

I hope this helps!

Regards,

Tim

[RFeyertag]

Thank you @timurphy! 

I would prefere a better appearance and more than 18 entries and more pages, when you send the pdf report. 

CSV is nice, but you need to format it and this takes some time. 

BR

Rob