A report is a template that is combined at run-time with a number of criteria, such as time parameters, user security filters, other filter criteria for the events to be displayed in the report. A single report may have numerous associated report results. Reports can range from a simple list of events to multiple graphs and tables.
You can manage the reports and report results in the Reports and Searches panel. To manage reports, you must have the Manage Reports permission.
Sentinel provides a variety of Solution Packs that enforce a specific business or technical policy. Some of the Solution Packs are available by default when you install Sentinel. These Solution Packs include various reports that you can use to solve your business needs.
You can also create new reports in the following ways:
Using an Existing Report: You can create a new report based on existing reports. These reports include predefined criteria for the events to be displayed in the report. To create a new report, select the report based on which you want to create a new report, click Create report, and then add additional criteria to suit your requirements.
NOTE:You can create new reports only from reports created by users in the same role as yours.
Using a Search Query: You can save your search query as a new report. For more information, see Saving a Search Query as a Report Template.
Importing from Solution Packs: You can update or install new Solution Packs to get new and updated reports. To download the new and updated Solution Packs, visit the Sentinel Plug-ins website. For information about installing and updating solution packs, see Managing Solution Packs in the NetIQ Sentinel Administration Guide.
To import new and updated reports, you must have the Import Reports permission. To import new and updated reports, click Import Reports and Searches.
Using the Sentinel SDK: You can use the Sentinel SDK to modify or write your own reports. For more information, see the Sentinel SDK website.