11.0 Reporting

Sentinel includes a variety of Solution Packs that contain out-of-the-box reports, some of which are device-specific. Some of the reports allow users to specify the columns Sentinel displays in the results. These reports use a Lucene-based query language.

When the Sentinel page is loaded for the first time, Sentinel loads the report definitions in the system and displays them in the Reports and Searches panel. You can also import the pre-packaged reports using Solution Packs. For more information, see Section 11.1, Importing Report Definitions.

You can create a report from an existing report and search for events based on the report definitions. You can also schedule, export, and email the reports.

You can schedule reports on Sentinel servers that are distributed across different geographic locations. For more information, see Searching and Reporting Events in a Distributed Environment in the NetIQ Sentinel 7.1 Administration Guide.

All report results depend on the data viewing permissions associated with the user's role. For more information, see Configuring Users and Rolesin the NetIQ Sentinel 7.1 Administration Guide.