Creating custom detection reports

Custom reports are created using one or more search queries entered in the Detection event stream of the Investigate module. You can either use an existing detection report as a basis or create one from scratch.

How to create a custom detection report from scratch

1. In the FortiDLP Console, on the left-hand sidebar, click .
2. Remain in the Event streams tab.
   By default, all events for the current day are aggregated.
3. Click the Detection event stream.
4. Enter one or more search queries using the search bar or context boxes of data on the page. See Viewing event streams and Performing Investigate searches for guidance.
5. On the top right of the page, click Save to detection reports.
   
6. In the dialog box, do the following:
   1. In the Name field, type a report name.
   2. Optionally, in the Description field, type a report description.
      
   3. Click Save.

How to create a custom detection report using an existing report

1. In the FortiDLP Console, on the left-hand sidebar, click .
2. Do one of the following:
   • To create a report based off of detections generated for a custom report, click on the relevant report.
   • To create a report based off of detections generated for entities assigned a flagged label, select the Flagged entities tab and then click on the relevant report.
   • To create a report based off of detections generated for a specific policy group, select the Policy groups tab and then click on the relevant report.

     You will be brought to the Detection event stream, which will be filtered by the policy group, flagged entity, or custom query that forms the report.

3. Modify the existing query using the search bar or context boxes. See Viewing event streams and Performing Investigate searches for guidance.
4. On the top right of the page, click Save to detection reports.
   
5. In the dialog box, do the following:
   1. In the Name field, type a report name.
   2. Optionally, in the Description field, type a report description.
      
   3. Click Save.