Scheduled Reports – Overview and Setup for Email Reports
This article goes over how to set up scheduled email reports from your Umbrella dashboard, as well as how to review, modify and delete a scheduled email report. The email you receive of the report will be a table showing an HTML version of the report, an attached CSV file containing the entire data set, and a link in the email to take you to a live version of the same report.
IMPORTANT NOTE: Umbrella uses MailGun as the service to deliver email. Some mail filters, either at the local level or even at a transport layer (like an ISP) may block communications from MailGun as marketing-related spam. If after scheduling your reports you do not receive them, check the spam filter at your mail server gateway. Whether your mail server gateway is hosted locally or in the cloud, it's likely the email was quarantined at that level.
The report will be sent to you from firstname.lastname@example.org
A Scheduled Report has a limit of 10,000 rows of information—one row per DNS request.
Adding a Scheduled Email Report
In the Umbrella dashboard, go to Reports > Scheduled Reports.
Click the icon to schedule a report. You'll be presented with a five step wizard, which includes the eight reports you can schedule, along with a brief description of each report.
You can also click the (Schedule this report) icon in any report, which will bring you to the same wizard.
Pick the report type you'd like, give your scheduled report a name and click Next.
The following reports can be scheduled:
Activity Search, Security Activity, Cloud Services, Activity Volume, Total Requests, Top Domains, Top Categories, and Top Identities
Pick the report from the list, and if you'd like to see an example of the selected report to jog your memory, click See a sample report.
Select the appropriate filters. It's important to add good filters so that your scheduled reports don't exceed 10,000 rows and that they're digestible and actionable by recipients. If you choose not to add any filters, the report will apply to all traffic types for that report across your entire environment. In Step 2 of the wizard, you can apply filters for an Identity and other key filters such as the security category or content setting, or the destination. The filters are different for each report type but match the filters that are already associated with the reports themselves. For instance, if you pick the Security Activity report, you can filter on Identity, Destination, Source IP, and Security Category.
Note: If you are adding a destination (a domain) or a source IP address, press Enter after entering your filter or it will not save.
Once you've added filters, the report settings should look like this:
Most reports will show "Filter by Security Categories", but the Cloud Services report will show "Filter by Classifications."
Step 3 of the wizard allows you to set the recipients for the email. Enter as many recipients as you like, pressing Enter, Space, or Tab, or entering a comma or semicolon after each email.
The email addresses do not have to be associated with existing administrators of the system. You can add any email address, including mailing lists and recipients outside your organization; therefore, you should use caution to ensure you don't add anyone who shouldn't be receiving the data within the report you chose.
In Step 4 of the wizard, you'll schedule the frequency of when you'd like the report to be sent.
Frequency can be set to Daily (once a day), Weekly (once a week), or Monthly (once a week).
If the frequency is daily, it can be either the previous calendar day or the last 24 hours from before the hour the report is scheduled to be delivered.
If the frequency is weekly, it can be set to be previous calendar week (from the date the report is scheduled to be delivered), or the last seven days.
The time of delivery will default to the logged in user's Umbrella's timezone, but if the recipients are in different time zones, you can configure them to receive reports during their work hours. If the recipient is an administrator or helpdesk staff expected to take action on information in the report, we recommend setting up a second report with the delivery time adjusted for their region.
Note: Attempting to schedule a report for a time on the current day, regardless of whether the report is scheduled in the future from the current time on that same day, will result in the report being scheduled on the next day at the earliest for weekly and monthly frequencies.
In Step 5 of the Wizard, you'll be asked to set a helpful description for this report or simply pick the autogenerated name. We recommend adding a purpose for the report and, where applicable, a brief description of any identity filters applied here.
Click Save to finalize the wizard and schedule your report.
Reviewing or Deleting a Scheduled Report
After you save the report, a summary of the report will appear:
Simply clicking anywhere on the report will bring you to back to the wizard. The details will include a note about who created the report and when, as well as the last time the report was modified and by whom. A note about when the next scheduled delivery is set will be here as well. If you have not received the report after the next scheduled delivery date, please check the spam filter at your mail server gateway, whether that's hosted locally or hosted in the cloud, as it's likely the email was quarantined at that level.
To make changes, just rerun the wizard and modify any aspect.
To delete the report, click Delete in the lower right-hand corner: