Reports
Daily / weekly / monthly: offense posture, top rules and entities, analysis activity, log-source health, model usage and health. Scheduled generation, archive and push.
A report gathers one period's security-operations data into one document. Generation is free, on demand or on a schedule, with archive and push. It is a tab of the Security posture page.
Generating one
Daily (last 24 h) / weekly (last 7 d) / monthly (last 30 d), seconds to a minute. "Regenerate" recomputes on fresh data. Data comes from the gateway's own copilot.db (offense copies, investigation records, audit) and QRadar's log-source catalogue; no Ariel search runs.
What is in it
| Section | Content |
|---|---|
| Executive summary | Four cards: offenses, critical + high, affected entities (source IPs / destination hosts / accounts), analysed (went through investigation or triage) |
| Timeline and severity mix | As on Security posture, for the period |
| Top rules / top entities | The noisiest rules, the most frequent subjects |
| Analysis activity | Investigations / triage runs in the period, high-severity share, common topics |
| Log-source health | Enabled, Error / Disconnected, silent for 6 h, total EPS, and the ten worst |
| Calls by action | Model calls by purpose: query generation, triage, investigation and so on |
| Top sources / top users | Most-queried source (events / flows), heaviest users, call success rate |
| Provider health | Status of each provider |
| Full report | Markdown: the model's executive summary (what happened, what deserves attention) plus every section's data; "Download .md" |
With RST_REPORT_TRIAGE=1 an automatic triage is appended (one model call; paid engine).
Schedule and archive
RST_REPORT_SCHEDULE=daily,weekly,monthly # empty = off
RST_REPORT_TZ=+08:00 # timezone of the period boundaries, follows RST_TIMEZONE
RST_REPORT_PERSIST=1 # archive in copilot.db (default)
RST_REPORT_CATCHUP_MAX=7 # periods to catch up after downtimeScheduled reports appear under "Scheduled archive" on the page, each with a system health check (state store writable, audit on).
Push
Two routes:
RST_REPORT_WEBHOOK_URL: every report is POSTed there (RST_REPORT_WEBHOOK_HEADERSoptional).- "Push schedule" in Outbound channels: period, send time, timezone, bound to Feishu / DingTalk / WeCom / Teams / Slack / mail targets.
Legacy reports
After an upgrade, older reports may show "legacy format" without the card layout. Regenerate them.
Security posture
The first screen after login: offenses in the window, high-severity count, log sources at risk, platform issues, and the top-10 noisiest rules and newest offenses.
Platform health
QRadar deployment checks: Console connection and version, managed hosts, EPS licence usage, log-source status, ingest freshness, offense backlog, auto-discovered log sources, each with a verdict; the paid AI reading ties the failing ones together and says what to fix first.