Proofpoint | ObserveIT On-Premises Insider Threat Management

Running Reports

This topic describes how to run a report and view the results in a separate webpage.

Running reports can generate additional CPU and resource usage on the SQL server holding the ObserveIT database. To prevent this overhead while the server is working, you should try to run reports that might cause very large queries (such as, reports that span a long period of time) during non-working hours. To help mitigate CPU and resource usage overhead, you can view cached reports that were run previously, instead of re-running them. In the Report List, by clicking the Cached link next to a report that was previously run, you can view the report's previous results. If a report was never run before, the Cached link will be disabled.

To run a report, view the report details, and launch a video session replay

1. In the Reports tab, click the Run link next to the report that you want to run. For example:

   

   Within a short time (depending on the type and range of report), the report is generated. The results are displayed in a separate webpage, and the information can be exported to an Excel spreadsheet, as shown in the following example:

   

   The information is displayed according to the column selection, grouping of results, session date range, and ordering of columns, that were defined during the creation of the report using the Report Configuration Wizard (see Creating a Custom Report).

2. To view more details of the report:

   • Select the group that you are interested in, and click Show Selected Details.

     -Or-

   • Click Show All Details to view the details of all the items in the report, as shown in the example below.

   

3. If the Play Video (Button) field was configured to be included in the report (see Application Report Configuration), you can replay the session from any point in time by clicking the Play Video icon at the right of an entry. The ObserveIT Session Player opens, enabling you to see, within seconds, the applications that were used, the actions that were performed by the user, and the relevance of the session to your troubleshooting process. In addition, you can see any alerts that were generated during the session (see Viewing Alerts in the Session's Video).

   

You can always return to the Report Configuration Wizard in order to add or remove columns, add or change sort-by options, add or change filters, and gradually generate the report you need by a trial and error process.