Reports Module

Introduction to Reports module

The Reports module provides access to predefined and customizable reports, enabling scheduled and ad hoc generation of compliance and operational summaries through an intuitive web interface.

The Reports module can be accessed by clicking the button, located in the left section of the Web Interface.

In addition to opening the Reports module and interacting with the included reports as described in this chapter, the Web Interface offers a quick search feature for locating specific reports. To access the Quick Filter box, first expand the Reports tree in the left section of the interface. Then, enter the report name or part of it into the Quick Filter box located at the top-right corner of the interface.

This module supports both scheduled and ad hoc reporting—either collectively or at a granular level—providing a comprehensive compliance and operational overview of IT environments. The interface restricts report visibility based on user authorization. Through this simple, web-based interface, authorized users can quickly access predefined and customizable reports to derive actionable insights.

Types of Reports

Available Reports

The CYBERQUEST Reports module includes both technological and compliance reports. The report tree is structured as follows:

• The Best Practices folder contains a collection of frequently used technology reports, summarizing and detailing technology best practices commonly adopted by customers.

• The Compliance folder provides access to all reports mapped to supported compliance standards, with addressed compliance requirements listed accordingly.

• The Custom Reports folder contains user-defined reports that are not included by default in CYBERQUEST.

• The GDPR folder contains a collection of reports related to General Data Protection Regulation (GDPR) compliance.

• The Linux folder provides access to reports specific to Linux systems.

• Each Technology Reports folder contains summarized and detailed reports specific to that technology, designed to assist operators in reporting on compliance-related issues.

• Accessing the Windows folder displays a collection of reports related to Windows system activity and performance.

Compliance Reports

The built-in CYBERQUEST reports are designed to support compliance with the following standards:

• COBIT (Control Objectives for Information and Related Technology)

• FISMA (Federal Information Security Management Act)

• GDPR (General Data Protection Regulation)

• HIPAA (Health Insurance Portability and Accountability Act)

• ISO 27001 (Information Security Standard)

• PCI DSS (Payment Card Industry Data Security Standard)

• SOX (Sarbanes-Oxley Act)

Managing Reports

To create, edit, or delete a folder, access the Reports module from the Web Interface. The following window will open:

• Creating a new folder press button and page will open:

Name: Enter the name of the new folder. This name will appear in the Reports list.

Description: Provide a description for the new folder.

Parent: Choose the location where the new folder will be added.

Complete the form and press "Save" button to save changes, or "Cancel" button to close the window without saving.

• To edit a folder, click on the Reports folder to display all available folders, then click the Edit icon next to the target folder.

This process follows the same steps as creating a New Folder.

• To delete a folder, click on the Reports folder to display all available folders, then click the button:

As a precaution, a confirmation prompt will appear. Click the button to confirm the deletion, or click the button to cancel the action.

Create Custom Reports

Access the Custom Reports folder to view reports that are not included by default in CYBERQUEST.

Navigate to the Dashboards module, accessible upon logging into the application or at any time by clicking the button located in the left section of the Web Interface.

Create a filtering rule to display self-audit events using the condition EventID:"56789". To save the result as a report, click SAVE OPTIONS > Save as New Report.

Complete the form

Complete in the form with the required information and click the button to proceed.

Name: The name of the new Report;

Description: Provide a description for the new report.

Save the reports

Choose the fields with the desired information and press the button.

The report will be saved on the "Reports" page, in "Custom reports" folder.

Schedule Reports

Selecting Schedules in the Reports and Schedules section of the Reports module displays a list of all defined report schedules.

Each listed schedule can be edited or deleted.

A new schedule can be created by clicking the button, which opens the schedule creation window:

• Name: Enter a descriptive name for the scheduled report;

• Report: Select the source report from the available drop-down list;

• Filter Data: Specify a filter query to define the data included in the report;

• Schedule Type: Define the report generation interval by selecting Daily, Weekly, or Monthly;

• Hour: Set the specific time of day when the report should be generated;

• Email Addresses: Enter the email addresses of recipients, one per line, without punctuation separators. There is no limit to the number of recipients supported by the scheduling engine.

Click Save to create the new schedule, or Cancel to discard the changes and return to the main interface.

Working with Reports module

Reports module interface is divided in two sections:

• Reports and schedules section allows you to navigate the reports folder structure and to select the report you want to action on, as well as creating, editing and deleting report schedules.

• Reports detail section allows you to edit, delete and execute a selected report.

The Reports module interface is divided into two main sections:

• Reports and Schedules: Enables navigation through the report folder structure, selection of specific reports, and management of report schedules (create, edit, delete).
• Report Details: Provides options to edit, delete, or execute the selected report.

Report detail window

Selecting a report from the list displays the Report Details window on the right, where the selected report can be edited, deleted, or executed.

The detail window includes the following elements:

• Report title and description located in the top-left corner, displays the full path, report name, and associated description;

• Edit button located in the top-right corner, used to modify the selected report;

• Delete button positioned next to the Edit button, used to remove the selected report;

• Report execution options allows execution of the report with optional filtering criteria applied.

Executing reports

To execute a report, ensure that the execution options panel is visible.

Execution options allow you to control in detail what data will be included in report:

• Start Date and End Date fields define the reporting period.
• The Items on page drop-down menu allows selection of the number of items displayed per page (100, 50, or 10).
• Enabling the Time Interval checkbox allows selection of specific time ranges for each day within the selected date range.
• A time reference indicator (LocalTime, GMT, or ReceivedTime) is displayed to the right. The selected option determines how time values are interpreted in the report.
• The Search field accepts custom queries to limit the data included in the report. This field supports the same syntax used in the Dashboards, Browser.
• Below the Filter Data box, a field selection panel is available to customize the report columns. Additional fields can be selected or deselected as needed.
• Reports can also be scheduled with the selected execution options by clicking the button in the details window. This opens the Add/Edit Schedule pop-up window:

Name: Enter a representative name for the scheduled report, or leave the default value;

Report: Displays the source report pre-selected from the main Report Details window. This can be changed using the drop-down list;

Filter Data: Contains the filtering query defined in the main Report Details window. The query can be modified as needed;

Schedule Type: Select the report execution interval (Daily, Weekly, or Monthly). Available configuration options will adjust based on the selected type;

Hour: Specify the hour at which the report should be executed;

Email Addresses: Enter the email addresses of the recipients. Each address must be entered on a separate line without punctuation. There is no limit to the number of recipients supported by the scheduling engine.

Click Save to create the new schedule, or Cancel to discard the changes and return to the main interface.

In main interface, press button to execute the report. Execution time depends on the query complexity, volume of data to be searched, and the number of items to be displayed. A simple search will list any volume in a matter of seconds.

All report results are dynamic, enabling further actions to expand the scope of reporting.

Clicking on any report field (except Description) opens a persistent pop-up menu with the following options:

• Remove globally: Generates a search query that excludes all events containing the selected field value. The resulting query is applied in the Search box.

• Show only this item globally: Filters the report results to display only events that match the selected field value. The updated query appears in the Search box.

• Send to Dashboards as <value> or <field>: Opens the Dashboards module in a new browser tab and displays search results filtered by the selected value or field.

• Send to Browser as <value> or <field>: Opens a new Browser tab showing events filtered by the selected field or value.

• Send to Alerts: Opens the Alerts module in a new browser tab and uses the selected field value to create and display a corresponding alert configuration.

The event list view provides a wide range of actions for interacting with individual events. These options enhance analysis, investigation, and reporting capabilities directly from the event table.

Managing report schedules

Selecting the Schedules option in the Reports and Schedules section of the Reports module displays a list of all defined report schedules.

For any of the schedules listed here, you can edit and delete them. You can also create a new schedule by pressing New Schedule button.

Adding a new schedule or editing an existing one opens Edit schedule pop-up window described above.

Editing reports

To edit a selected report, click the button located in the top-right corner of the Reports interface. This action opens the Edit Report pop-up window:

• Name: Modify the report name, or leave the existing name unchanged.
• Parent: Use the drop-down list to move the report to a different folder within the report structure.
• Description: Update the report description, or retain the current tex

Press "Save" to apply the changes, or "Cancel" to discard them and return to the main interface.

Deleting reports

To delete a selected report, click the button located in the top-right corner of the Reports interface.

A confirmation dialog will appear. Click to confirm deletion, or click to cancel and return to the main interface.

Export data from reports

The module supports both scheduled and ad hoc reporting all, at once or granularly providing a complete overview of compliance and operational activity within the IT environment.

For detailed instructions on how to export data from Reports, refer to: How to export data from Reports.

Import reports

A report definition can be imported from an external .CQO file, which uses CYBERQUEST’s proprietary format.

To import a report definition, click the button.

Next, select the file to be imported and specify the Parent folder - this defines the location where the report will be added.

Report execution scenario example

Step 1: Open the Reports module from the Web Interface.

Step 2: Navigate to the Windows reports folder and select the Windows All User Activities report.

Step 3: Define the desired Start Date and End Date for the report.

Step 4: In the Filter Data field, enter simple or complex queries using logical operators (AND, OR, NOT). For example, to generate results for specific users and a particular category (e.g., Logoff), a filter like the following can be used:

UserName:(user1 OR user2) AND EventCategory:Logoff

Step 5: Search results are displayed in the lower section of the web page, sorted in ascending chronological order. To view event details, click on the corresponding field. The results section also shows the total number of results (Total results), the number of pages, and the currently active page.

How to create a new report and how to run it

For detailed instructions on creating and running a new report, refer to the following guide: How to create a new report and how to run it