Skip to main content

createReport

This method creates a new instant or scheduled report, based on the parameters received, and returns the ID of the new created report.

The instant report is created and runs one-time-only at the API call.

The scheduled report is created at a later time and runs periodically, based on a predefined schedule.

Parameters

Parameter

Type

Optional

Description

name

String

No

The name of the report.

type

Number

No

The type of report. One of the following values can be passed:

  • 1 - Antiphishing Activity

  • 2 - Blocked Applications

  • 3 - Blocked Websites

  • 4 - Customer Status Overview

  • 5 - Data Protection

  • 6 - Device Control Activity

  • 7 - Endpoint Modules Status

  • 8 - Endpoint Protection Status

  • 9 - Firewall Activity

  • 10 - License Status

  • 12 - Malware Status

  • 13 - Monthly License Usage

  • 14 - Network Status

  • 15 - On demand scanning

  • 16 - Policy Compliance

  • 17 - Security Audit

  • 18 - Security Server Status

  • 19 - Top 10 Detected Malware

  • 20 - Top 10 Infected Companies

  • 21 - Top 10 Infected Endpoints

  • 22 - Update Status

  • 23 - Upgrade Status

  • 24 - AWS Monthly Usage

  • 29 - Email Security Usage

  • 30 - Endpoint Encryption Status

  • 31 - HyperDetect Activity

  • 32 - Network Patch Status

  • 33 - Sandbox Analyzer Failed Submissions

  • 34 - Network Incidents

  • 35 - MDR Service Status

  • 36 - Integrity Monitoring Activity

  • 37 - Integrity Monitoring Configuration Changes

  • 38 - Mobile Security Monthly License Usage

targetIds

Array

No

A list with the IDs of the targets for which to create the report. The targets depend on the report type. For these reports, the target can be only the ID of the user's company or IDs of child companies:

  • Customer Status Overview

  • License Status

  • Monthly License Usage

  • AWS Monthly Usage

  • Top 10 Infected Companies

  • MDR Service Status

  • Email Security Monthly License Usage

  • Mobile Security Monthly License Usage

For the other report types, the target ID can be of any type: group, company, containers, endpoints.

scheduledInfo

Object

Yes

The object that defines the schedule to run the report. If the parameter is omitted, an instant report is generated. For more information, please check the details of the scheduledInfo object.

options

Object

Yes

The object that defines the options for creating the report. For these reports, the options object should not be set:

  • Endpoint Modules Status

  • License Status

  • Policy Compliance

  • Security Server Status

  • Upgrade Status

  • MDR Service Status

For more information, please check the details of the options object.

emailsList

Array

Yes

A list of emails where to deliver the report. emailsList should not be set for an instant report.

Objects

scheduledInfo

This object is used by the createReport call and it defines the schedule based on which the report will run.

The object contains a variable number of members, depending on the occurrence of the report:

Name

Type

Description

occurrence

integer

The member is mandatory.

Possible values:

  • 1 - for an instant report

  • 2 - for hourly report

  • 3 - for daily report

  • 4 - for weekly report

  • 5 - for monthly report

  • 6 - for yearly report

For 13 - Monthly License Usage and 24 - AWS Monthly Usage reports the possible values are only 4 - weekly report and 5 - monthly report.

For 29 - Email Security Usage and 38 - Mobile Security Monthly License Usage reports the possible values are only 5 - monthly report and 6 - yearly report.

interval

integer

The member should be set only if occurrence has the value 2.

Possible values:

  • Any integer between 1 and 24, representing the interval (in hours) at which the report will run.

startHour

integer

The member should be set only if occurrence has the value 3, 4 or 5.

Possible values:

  • Any integer between 0 and 23.

startMinute

integer

The member should be set only if occurrence has the value 3, 4 or 5.

Possible values:

  • Any integer between 0 and 59.

days

array

The member should be set only if occurrence has the value 4.

Possible values of the array elements:

  • Integers between 0 and 6, representing the days of the week, from 0 - Sunday to 6 - Saturday.

day

integer

The member should be set only if occurrence has the value 5 or 6.

Possible values:

  • An integer between 1 and 31, representing the day of the month.

month

integer

The member should be set only if occurrence has the value 6.

Possible values:

  • An integer between 1 and 12, representing the month of the year.

options

This object is used by the createReport call and contains a variable number of members, depending on the report type:

  • Antiphishing Activity

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

    filterType

    integer

    The member is mandatory.

    Possible values:

    • 0 - All endpoints

    • 1 - Only endpoints with blocked websites

  • Blocked Applications

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Blocked Websites

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

    filterType

    integer

    The member is mandatory.

    Possible values:

    • 0 - All endpoints

    • 1 - Only endpoints with blocked websites

  • Data Protection

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

    filterType

    integer

    The member is mandatory.

    Possible values:

    • 0 - All endpoints

    • 1 - Only managed computers with blocked threats

    blockedEmails

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True

    • False

    blockedWebsites

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True

    • False

  • Device Control Activity

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Endpoint Protection Status

    The object must contain these members:

    Name

    Type

    Description

    filterType

    integer

    The member is mandatory.

    Possible values:

    • 0 - All endpoints

    • 1 - Only endpoints filtered by the members described hereinafter.

    antivirusOn

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True, to include in the report endpoints with antimalware protection enabled.

    • False, to exclude from the report endpoints with antimalware protection enabled.

    antivirusOff

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True, to include in the report endpoints with antimalware protection disabled.

    • False, to exclude from the report endpoints with antimalware protection disabled.

    updated

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True, to include in the report updated endpoints.

    • False, to exclude from the report updated endpoints.

    disabled

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True, to include in the report endpoints with update disabled.

    • False, to exclude from the report endpoints with update disabled.

    outdated

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True, to include in the report outdated endpoints.

    • False, to exclude from the report outdated endpoints.

    online

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True, to include in the report online endpoints.

    • False, to exclude from the report online endpoints.

    offline

    boolean

    The member should be set only if filterType has the value 1.

    Possible values:

    • True, to include in the report offline endpoints.

    • False, to exclude from the report offline endpoints.

  • Firewall Activity

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

    filterType

    integer

    The member is mandatory.

    Possible values:

    • 0 - All endpoints

    • 1 - Only endpoints with the following blocked threats: traffic attempts and port scans.

    trafficAttempts

    boolean

    This member should be set only if filterType has the value 1.

    Possible values:

    • True, to include in the report endpoints with blocked port scans.

    • False, to exclude from the report endpoints with blocked port scans.

  • Malware Status

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

    filterType

    integer

    The member is mandatory.

    Possible values:

    • 0 - All endpoints

    • 1 - Only endpoints still infected

    detailedExport

    array

    The member is optional.

    Possible values:

    • 1 - Include Endpoint Malware Status in PDF file

  • Monthly License Usage

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

    skipSummary

    boolean

    The member is optional.

    An option defining if the CSV file of the Monthly License Usage report (type = 13) should include the Summary section. By default, the parameter is set to False, meaning the CSV file includes the Summary.

  • AWS Monthly Usage

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Network Status

    The object must contain these members:

    Name

    Type

    Description

    filterType

    integer

    The member is mandatory.

    Possible values:

    • 0 - All endpoints

    • 1 - Only endpoints with issues

    • 2 - Only endpoints with unknown status

  • On demand scanning

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Security Audit

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Top 10 Detected Malware

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Top 10 Infected Endpoints

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Update Status

    The object must contain these members:

    Name

    Type

    Description

    updated

    boolean

    Possible values:

    • True, to include in the report updated endpoints.

    • False, to exclude from the report updated endpoints.

    disabled

    boolean

    Possible values:

    • True, to include in the report endpoints with update disabled.

    • False, to exclude from the report endpoints with update disabled.

    outdated

    boolean

    Possible values:

    • True, to include in the report outdated endpoints.

    • False, to exclude from the report outdated endpoints.

    pendingRestart

    boolean

    Possible values:

    • True, to include in the report endpoints that need to be restarted.

    • False, to exclude from the report endpoints that need to be restarted.

  • VM Network Protection Status

    The object must contain these members:

    Name

    Type

    Description

    filterType

    integer

    The member is mandatory.

    Possible values:

    • 0 - All endpoints

    • 1 - Only protected endpoints

  • Email Security Usage

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • HyperDetect Activity

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Network Patch Status

    The object must contain these members:

    Name

    Type

    Description

    filterType

    integer

    Possible values:

    • 0 - All available patches

    • 1 - Only patches visible in Patch Inventory

  • Sandbox Analyzer Failed Submissions

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Network Incidents

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Integrity Monitoring Activity

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

  • Integrity Monitoring Configuration Changes

    The object must contain these members:

    Name

    Type

    Description

    reportingInterval

    integer

    The member is mandatory.

    This value depends on the report occurrence. For more information, refer to Relation between reporting interval and recurrence.

Important

The object should not be set for these reports:

  • Endpoint Modules Status

  • License Status

  • Upgrade Status

  • Policy Compliance

  • Security Server Status

  • Endpoint Encryption Status

  • MDR Service Status

Relation between reporting interval and recurrence

occurrence

reportingInterval

2 - Hourly report

Possible values:

  • 0 - Today

3 - Daily report

Possible values:

  • 0 - Today

  • 1 - Last day

  • 2 - This Week

4 - Weekly report

Possible values:

  • 0 - Today

  • 1 - Last day

  • 2 - This Week

  • 3 - Last Week

  • 4 - This Month

For 13 - Monthly License Usage, 24 - AWS Monthly Usage and 29 - Email Security Usage reports the possible value is only 4 - This Month.

5 - Monthly report

Possible values:

  • 0 - Today

  • 1 - Last day

  • 2 - This week

  • 3 - Last week

  • 4 - This month

  • 5 - Last month

  • 6 - Last 2 months

  • 7 - Last 3 months

  • 8 - This year

For 13 - Monthly License Usage and 24 - AWS Monthly Usage reports the possible values are only 4 - weekly report and 5 - monthly report. For 29 - Email Security Usage reports the possible values are only 5 - monthly report and 6 - yearly report.

6 - Yearly report

Possible values:

  • 8 - This year

  • 9 - Last year

Return value

This method returns a String: the ID of the created report.

Example

Request:

  {
       "params": {
           "name": "My Report hourly",
           "type": 1,
           "targetIds": ["559bd17ab1a43d241b7b23c6",
                        "559bd17ab1a43d241b7b23c7"],
           "scheduledInfo": {
                "occurrence": 2,
                "interval": 4
            },
            "emailList": ["[email protected]",
                          "[email protected]"]
       },
       "jsonrpc": "2.0",
       "method": "createReport",
       "id": "787b5e36-89a8-4353-88b9-6b7a32e9c87f"
  }  

Request:

  {
       "params": {
           "name": "My Report daily",
           "type": 8,
           "targetIds": ["559bd17ab1a43d241b7b23c6",
                        "559bd17ab1a43d241b7b23c7"],
           "scheduledInfo": {
                "occurrence": 3,
                "startHour": 10,
                "startMinute": 30
            },
            "options": {
                "filterType": 1,
                "antivirusOn": true,
                "antivirusOff": false,
                "updated": true,
                "disabled": false,
                "outdated": false,
                "online": false,
                "offline": true
            }
       },
       "jsonrpc": "2.0",
       "method": "createReport",
       "id": "787b5e36-89a8-4353-88b9-6b7a32e9c87f"
  }  

Response:

  {
      "id": "787b5e36-89a8-4353-88b9-6b7a32e9c87f",
      "jsonrpc":"2.0",
      "result": "563c78e2b1a43d4043d60413"
  }