Create an intelligence report
Create an intelligence report from the Reports module in the Threat Intelligence Library by using a published intelligence template and populating it with intelligence from library lists and slash commands, independent of a case.
Before you begin
The intelligence report template must be published. For more information, see Configure report templates.
Role required: sn_sec_tisc.analyst
About this task
Intelligence reports use templates that have an Intelligence report context. Unlike case reports, intelligence reports are independent of a case, and the editor does not display case-specific fields. The navigator displays all the lists from the Threat Intelligence Library, and you use record-selection tools and slash commands to add content. Only published templates are available for selection.
Procedure
Navigate to Workspaces > Threat Intelligence Security Center > Threat Intel Library.
Select Reports > Intelligence Reports.
The list of intelligence reports is displayed.
Select New Intelligence Report.
Enter a name for the report and select Next.
Note: Intelligence reports do not require a case selection.
Select the required intelligence report template.
The report is generated and opens in an editable view in the Report Content tab.
Select the Report Content tab to build the report content.
- Select the Expand icon to insert additional content — for example, Observables or Indicators — into the report.
- Type
/to use a slash command and insert dynamic content, such as a record count, a specific record or field, or a system user. For the available slash commands and supported tables, see Working with Reports in TISC. - Select Save Content to save your changes and enable Publish.
- Select Preview to generate a PDF preview of the current content.
- Select Popout to view or edit the report in a separate window.
- Select Save Details to save the report details.
Select Publish to publish the report.
Important: After publishing, the report is read-only. To download or share the report after editing, republish it.
A confirmation message is displayed before the report is published.
Select Duplicate from the overflow menu to create a copy of the report.
Note: You can also duplicate reports from the list view. Duplicate reports are created in the Draft state.
After the report is published, download or share it.
- Select Download to download the published PDF.
- Select Share to share the report by email.
Parent Topic:Working with Reports in TISC