WEBVTT

1
00:00:00.616 --> 00:00:11.472
Welcome to NxSAM training. This module covers Reports: how the platform turns what it knows into something you can send to somebody who does not use it.

2
00:00:11.754 --> 00:00:29.788
That last part is the design brief. Almost nobody who reads a security report logs into a security platform. So a report is not a screen - it is a document that has to make sense on its own, to a person with no filters and no context.

3
00:00:30.366 --> 00:00:33.667
Start with what has already been produced.

4
00:00:34.267 --> 00:00:51.243
Report Detail names it. Output Type is the format. Generated From says what produced it. Created At is when. Status is where it got to. And Time Taken is the column people overlook.

5
00:00:51.842 --> 00:01:07.143
Time Taken is worth watching over weeks rather than once. A report that took forty seconds last quarter and four minutes this one is telling you the underlying data set is growing - which is a capacity signal long before anything fails.

6
00:01:07.728 --> 00:01:21.132
Status matters because generation is queued rather than instant. A report covering tens of thousands of findings is real work, and holding a browser open while it runs would be the wrong design.

7
00:01:21.725 --> 00:01:36.042
So when a report has not arrived, read this list before assuming the data is wrong. It will say whether the job is waiting, running, finished or failed - and a failed job usually failed for a stated reason.

8
00:01:36.673 --> 00:01:53.504
The chips above the table are the queue's own states, and they are worth knowing as a set: pending, in progress, completed, cancelling and cancelled. A report sitting in the first two for a long time is not the same problem as one that reached failed.

9
00:01:54.110 --> 00:02:07.489
More Filters carries the two that are not on the chips - the type of report and the format it was produced in. On a busy instance those are how you find one particular run rather than scrolling for it.

10
00:02:08.101 --> 00:02:11.591
Assessment reports are the per-audit documents.

11
00:02:12.181 --> 00:02:26.759
Application Name and Audit Name tie the report to what it covers. Report Details names the file and gives its size. Created and Updated On record when it was produced and when it was last regenerated.

12
00:02:27.320 --> 00:02:42.499
The size, in megabytes, is more useful than it looks. A report far larger than its siblings usually means an audit with an unusual volume of findings or evidence - worth knowing before you email it to somebody.

13
00:02:43.083 --> 00:02:56.365
And the created-versus-updated pair answers a question that comes up in disputes: whether the document somebody is holding is the one originally issued, or a later regeneration with different numbers in it.

14
00:02:56.971 --> 00:03:01.569
Templates are where the format is decided, and there are two kinds.

15
00:03:02.162 --> 00:03:13.306
The template list carries Template Id and Name, Template Type, Asset Type, Output Type, the Design Template it uses, who created it, and a download.

16
00:03:13.900 --> 00:03:30.425
Asset Type and Output Type together decide where a template can be used. A template built for web applications will not appear when you are reporting on network hosts - which is the usual reason somebody cannot find the template a colleague described.

17
00:03:31.014 --> 00:03:53.032
The row menu is not the same on every row, and the difference matters. On a template you own, six actions: View, Edit, Delete, the two sharing actions, and Run. A supplied template is locked - Run and Manage Config. One shared to you as a view offers only View and Run.

18
00:03:53.611 --> 00:04:08.597
And the two sharing actions are worth distinguishing. Share View Template lets somebody use it as it is. Share Copy Template gives them their own copy to modify - so their changes do not alter yours.

19
00:04:09.196 --> 00:04:18.520
That distinction prevents the commonest template accident: two teams editing one shared template and each wondering why their layout keeps changing.

20
00:04:19.149 --> 00:04:25.901
Run Template is the one that produces a report, and it asks for the scope rather than assuming it.

21
00:04:26.512 --> 00:04:45.146
Organisation, business unit, project, application, audit. Each choice narrows the next, so the audit list you end up with is only the audits that belong to everything above it. That is what stops a report being run against the wrong client's data.

22
00:04:45.738 --> 00:05:00.534
Then the part people miss: which findings to include. All, open only, or closed only. A report that looks empty is usually this set to closed on an audit where nothing has been closed yet.

23
00:05:01.123 --> 00:05:14.429
And Mark as Rescan Report records that this run is a re-test of work already reported, rather than a first assessment. It changes how the finished report is read, not what it contains.

24
00:05:15.009 --> 00:05:22.294
Creating a template starts with three answers, and the two dropdowns decide everything that follows.

25
00:05:22.903 --> 00:05:39.356
Asset Type fixes what the template can report on, and Report Type fixes its shape. Both are set once, here, and neither can be changed afterwards - so a template built against the wrong asset type is a new template, not an edit.

26
00:05:39.921 --> 00:05:46.582
Deleting is the other end of that, and it is worth seeing what the product asks before it lets you.

27
00:05:47.170 --> 00:05:59.228
The confirmation names the template back to you rather than simply asking whether you are sure. Template names differ by a word more often than they should, so it is worth reading.

28
00:05:59.834 --> 00:06:11.220
And a template that has been shared is not yours alone any more, so a deletion reaches further than your own list. Cancel leaves everything as it was.

29
00:06:11.832 --> 00:06:28.741
Two rows here are not yours at all. A supplied template is marked as a system template and carries a lock: it can be run, but not edited, shared or deleted - and it has no design template, because the layout is fixed by the product.

30
00:06:29.336 --> 00:06:34.770
One of them is worth opening, because running it is not the form you have just seen.

31
00:06:35.367 --> 00:06:50.830
Key Risk Indicators are reported across the estate rather than against one audit. So there is no audit to choose, and the form asks a different question entirely: which organisation and business unit, over what period.

32
00:06:51.417 --> 00:07:03.549
Then two fields that look alike and behave in opposite ways, and the product says so in the small print under each. Leaving policy categories empty includes every category.

33
00:07:04.120 --> 00:07:19.635
But the group list is an exclusion. Anything you select there is left out, and leaving it empty includes everything. Two adjacent fields, one an include and one an exclude - read the line under each before you run it.

34
00:07:20.205 --> 00:07:28.999
And the end date is required, because a key risk indicator is a measurement at a point in time rather than a list of what is open today.

35
00:07:29.580 --> 00:07:39.580
Custom templates are for the question the supplied ones do not answer - your board's format, a regulator's structure, a client's contractual reporting.

36
00:07:40.180 --> 00:07:52.407
The list carries Template Id, Name, Template Type, Audit Type, and a Default marker - which is the template used when nobody chooses one, so it is worth setting deliberately.

37
00:07:53.020 --> 00:08:06.404
A custom template is built from sections, and sections from blocks. A block is one piece of content: a chart, a table of findings, a count, a paragraph of your own text.

38
00:08:07.020 --> 00:08:19.196
This list is the skeleton of every report the template will ever produce. The order here is the order on the page, so a reader meets the sections in exactly this sequence.

39
00:08:19.780 --> 00:08:29.153
Opening a section shows the blocks inside it. Each one is a piece of the finished document, numbered in the order it will appear.

40
00:08:29.740 --> 00:08:43.887
The blocks describe what to show, not what the numbers are. That is what makes a template reusable: the same one produces this quarter's report from this quarter's data, without being rebuilt.

41
00:08:44.480 --> 00:08:55.533
Each block can be edited in place, and that is where your own wording goes. The product supplies the structure and the figures; the words around them are yours.

42
00:08:56.140 --> 00:09:12.351
The section menu carries the three structural changes: rename it, add a sub-section beneath it, or re-order the sub-sections it already has.

43
00:09:12.920 --> 00:09:21.570
Renaming changes only the heading a reader sees. It does not change what the section contains, which matters when somebody has asked for a particular wording in a particular place.

44
00:09:22.160 --> 00:09:32.324
Sub-sections are how a section gets a hierarchy - findings grouped by system, or by severity, under one heading rather than as one long list.

45
00:09:32.940 --> 00:09:46.438
Worth knowing before you look for it: these two are offered only on content sections. A cover page or an executive summary is a fixed block, so it has a name to change and nothing to nest.

46
00:09:47.000 --> 00:09:52.506
Adding a whole section asks for two things, and the second is the one people skip.

47
00:09:53.100 --> 00:10:05.804
The name is the heading. The position is where it lands in the running order - and because the order here is the order in the document, choosing it now saves re-arranging the whole template afterwards.

48
00:10:06.420 --> 00:10:20.376
Two different saves sit on this screen and they do not mean the same thing. Save template design commits the structure you have built. The changes bar at the foot commits edits to the blocks inside it.

49
00:10:20.980 --> 00:10:34.862
And Default template decides which design is used when a report is run without anyone choosing one. On a busy team that is most of them, so it is worth being deliberate about which template carries it.

50
00:10:35.440 --> 00:10:51.650
One structural point. A template's identity is unique across the whole system, not just within your own templates - so name them for what they report and who they are for, rather than discovering somebody already has a Quarterly Report.

51
00:10:52.240 --> 00:10:58.154
Report search is a different tool from the rest of this module, and it is under-appreciated.

52
00:10:58.730 --> 00:11:11.632
It opens empty on purpose. This screen searches the whole estate rather than one audit, so it waits for you to narrow it before it fetches anything - pick your scope, then search.

53
00:11:12.218 --> 00:11:19.308
Narrow it to one organisation, and the search becomes available - it stays disabled until you do.

54
00:11:19.882 --> 00:11:28.606
Now it fetches - and only now, because a search across every finding in the estate is not something to run by accident.

55
00:11:29.209 --> 00:11:50.101
It searches across findings rather than documents, and it carries the widest column set in the product: the finding's number and issue type, the full organisational path - organisation, business unit, project, application - the audit and its type and category, and whether that audit was considered and complete.

56
00:11:50.700 --> 00:12:03.286
Audit Considered is the column worth understanding. It says whether that audit counts towards the current position, which is how the same finding can appear in a search and not in a posture figure.

57
00:12:03.880 --> 00:12:17.187
Two actions sit on each row. Vulnerability History and View S L A History answer what happened and when - how a finding reached its current state, and whether the clock on it was ever met.

58
00:12:17.760 --> 00:12:22.642
And the overall vulnerabilities report is the estate-wide position.

59
00:12:23.260 --> 00:12:33.736
It carries its own configuration - Manage configuration decides what it includes - and it can be regenerated on demand rather than only on a schedule.

60
00:12:34.340 --> 00:12:45.847
Manage configuration is where the report's shape is decided, and it is the answer to the commonest question this screen produces: why does my export not carry the column I need.

61
00:12:46.460 --> 00:13:02.411
Each row is an asset property your organisation records. Selecting one adds it to the report as a column. The two at the top are supplied by the product and cannot be removed, which is why they are locked rather than simply ticked.

62
00:13:03.020 --> 00:13:20.188
The second column is the one worth understanding. Check Linked Assets widens a property to the assets connected to the one being reported, rather than only the asset itself - so a finding on a host can carry the classification of the application in front of it.

63
00:13:20.760 --> 00:13:37.287
Downloading offers two versions, and the difference is not cosmetic. The current overall report is built from the configuration you have just seen. The old one is the previous format, kept because teams have processes built around it.

64
00:13:37.900 --> 00:13:56.246
And the tabs across the top narrow the whole report to one kind of work - application security, network V A, penetration testing, policy configuration, red teaming. All of them together is the default, and it is rarely what somebody actually wants to send.

65
00:13:56.860 --> 00:14:08.580
Regenerate is the one to reach for when the report disagrees with a dashboard. It rebuilds from current data, which either resolves the discrepancy or proves it is real.

66
00:14:09.178 --> 00:14:14.327
A word about content, because this is where most templates go wrong.

67
00:14:14.593 --> 00:14:29.843
The temptation is to include everything, on the reasoning that more information is more useful. For a reader who does not use the platform the opposite is true - a report with sixty charts communicates less than one with six.

68
00:14:30.446 --> 00:14:41.448
The blocks that earn their place answer a question the reader actually has: is this better or worse than last time, where is the risk concentrated, and what is overdue.

69
00:14:42.052 --> 00:14:57.833
Your own text blocks matter more than they look. A chart shows that a number moved; only a sentence can say why, and whether it was expected. That sentence is usually the only part a senior reader remembers.

70
00:14:58.416 --> 00:15:16.332
That is Reports. A produced list whose status and time tell you what happened, assessment reports per audit, supplied and custom templates with sharing that protects your layout, a search across findings rather than documents, and an overall position you can regenerate.

71
00:15:16.600 --> 00:15:31.713
Three habits. Read the report list before assuming data is wrong. Use Share Copy rather than Share View when somebody wants to change something. And write for the reader rather than for completeness.