Reports
Daily, weekly and monthly SOC operations summaries, a seven-section incident report, archive, Markdown export, push to Feishu or open a ticket.
Reports is a tab of the Security posture page. This page covers periodic operations reports and the incident report produced after an investigation.
Operations reports
Generate a summary for a period (day, week, month, or a custom range) from this instance's own data:
| Section | Source |
|---|---|
| Executive summary | The model's summary of the sections below (paid engine; without a licence only the tables appear) |
| Alert posture | Alert index: totals, by severity, top rules and subjects (enriched with names and criticality from the Asset inventory) |
| Investigations | Investigation, triage and explanation counts and severity split in the period |
| Triage | Clusters, likely false-positive share |
| Baseline | Latest patrol score and failed checks |
| Audit and usage | AI calls, success rate, tokens, top indexes |
| Platform health | Check-up verdict |
Generated reports join the archive (KV copilot_reports; custom ranges are not archived) for review, Markdown download and Push to Feishu (an alert card through Outbound channels). Scheduled generation is set under Schedule on the channels page (hour, time zone).
Incident report
After an investigation, Generate incident report produces a seven-section Markdown document (overview, blast radius, timeline, attack chain, evidence, recommended actions, open items) for download, push to a channel, or Open ticket as the ServiceNow or Jira body. The incident report itself needs no licence, but the investigation it draws on does.
Limits
| Item | Notes |
|---|---|
| Time zone | Time windows in report SPL are passed to Splunk as %m/%d/%Y:%H:%M:%S in the splunkd process time zone. A searching user with another zone sees an offset |
| Top indexes | Counts only calls whose audit event recorded index= |
Alerts
A polled feed of the alert index, handled one by one. Explain, investigate (autonomous evidence gathering), escalate to triage, write back to the ES notable, open a ticket. Reachable from Incident Review's row menu.
Platform health
An eight-point Splunk check-up with AI interpretation. The slow-search advisor finds the most expensive searches in _audit, rewrites them, verifies by result count on real data and applies them to the saved search.