Building Reports

These topics describe how you use ArcSight reports to monitor enterprise security.

Reports are captured views or summaries of data that can be viewed in the ArcSight Console or exported for sharing in a variety of file formats. Reporting is an essential tool for communicating the state of your enterprise security to internal and external stakeholders.

Reporting is a broad subject in ArcSight. Because it can use all the scheduling, conditional logic, resource- and rules-based filtering capabilities of the system, the possibilities can take some time to explore. Creating a report is a multi-step process that can involve steps using several different resources.

When you have source data defined in queries or trends, you can create reports to present the data in charts and tables. Use one of the templates provided with ArcSight.

The reports resource defines how query data is bound to a report template. Depending on the report template you use, the reports editor exposes different parameters, variables, and conditions that enable you to choose which elements of the query data you want to show in the report. You can also apply additional functions to run on the data, and set numerous formatting options.

See also Running and Managing Reports and Archiving and Scheduling Reports.