Reporting

[jfox]

What is the consensus on EDR reporting? The executive summary is quite lacking and any other reporting is non-existent in the console. 

[nicerobot_FTNT]

Did you see the option under the admin login name on the upper right side: Generate Reports? That has options for selecting dates, etc for reporting. You can export that output to pdf (Save/Print) option at the bottom. You might have to expand your window, I didn't see it the first few times I was in the EDR console.

[nicerobot_FTNT]

I think I see what you mean. Sorry didn't see that you don't like the Executive Report. While you can export from the Events or Threat Hunting fields into CSV or PDF, it doesn't provide a nice graphic output.  What kind of information would be sufficient data in the reports? 

[jfox]

Not everything on the executive summary is bad. I'd like a way to report on or customize the executive summary to include 

- Collector inventory with collector status, version, # of events, # of vulnerable applications. 

- A top 10 collectors by event

- A top 10 vulnerable applications 

Really should have a reporting engine in this platform. A way for a MSSP or tenant to generate reports, schedule reports, customize reports, brand reports, etc. Probably the biggest GAP it has against competitiors.