02-15-2022 06:42 PM - edited 02-15-2022 06:42 PM
Hi @chukaokonkwo This is listed in the XDR guide (Create a Report from Scratch Step 11): https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/monitoring/cortex-xdr-dashb...
Please see an example below:
1. Create a custom XQL widget (Reporting -> Widgets Library) which will provide the data you need, and save it. In my example, I am listing endpoints without EED capabilities. My end goal is to obtain the results as a CSV format.
2. Create a new Report template and click Next twice after designing your template. I have left mine as blank as an example.
3. Choose the custom XQL Query (the same widget you created in Step 1) in the drop-down menu and click Save.
4. If you chose "Generate Now" in step 3, the report will be present as a zipped file in the Reports section. If you have set a schedule, the reports will be created as per schedule.
See an example where the report results were created in CSV format for the XQL query in step 1.
