Reports
Daily / weekly / monthly reports: alert posture, top rules and entities, baseline pass rate, model usage and health. On demand or scheduled, archived and pushed.
Reports turn a period of security-operations data into one document. Generating is free, on demand or on a schedule with archive and push. In the tabs of Posture.
Generating one
Daily (last 24 hours) / Weekly (last 7 days) / Monthly (last 30 days); seconds to a minute. "Regenerate" recomputes with the latest data.
What is in it
| Block | Content |
|---|---|
| Executive summary | Four cards: alerts, critical + high, affected entities (hosts / accounts / IPs), analysed (went through investigation or triage) |
| Alert timeline and severity mix | As on Posture, for the period |
| Top rules / top entities | Flooding rules; most frequent hosts / accounts / IPs |
| Baseline | Runs in the period, pass rate, last run |
| Calls by action | Model calls by purpose: queries, triage, investigations |
| Top indices / top users | Most queried indices, heaviest users, success rate |
| Model service health | Each provider's status |
| Full report | Markdown: the model-written summary (what happened, what deserves attention) plus every block's data; "Download .md" |
Scheduling and archive
RST_REPORT_SCHEDULE=daily,weekly,monthly # empty = off
RST_REPORT_TZ=+08:00 # period boundaries; defaults to RST_TIMEZONE
RST_REPORT_PERSIST=1 # archive to ES (default on)
RST_REPORT_CATCHUP_MAX=7 # periods to catch up after downtimeScheduled reports appear under "Patrol archive" on the page, each with a system health check (ES writes OK, audit on) and an alert triage check (clusters auto-triaged this period, how many high; needs RST_REPORT_TRIAGE_INDEX). Archived in .rst_copilot_reports.
Push
Two routes:
RST_REPORT_WEBHOOK_URL: every report is POSTed there (optionalRST_REPORT_WEBHOOK_HEADERS).- The schedule in Notifications: periods, send hour, timezone, bound to Feishu / DingTalk / WeCom / mail destinations.
Legacy-format reports
After an upgrade older reports may show "legacy format"; they predate the card layout. Regenerate them.
Live alerts
Ingest Elastic Security detection alerts (polling or webhook), each with an automatic summary; group, filter and disposition them in the feed; investigate a single alert.
Platform health
A check-up of the Elastic cluster: cluster state, shards, disk, ILM, time baseline, permissions, with a verdict per item; the paid "AI read" ties failing items together and says what to fix first.