KSA-ECC User Guide – Reports and Reporting Packages

Summary and Detail Reports

KSA-ECC reporting is broken into summary and detailed reports to present various audiences with appropriate forensic log data. Summary reports provide a higher level of information that may be appropriate for some audit and executive management requests. Detail reports provide additional information, sometimes including raw log data, to facilitate IT and security operations. Additionally, any report can be run as an investigation to delve into forensic information around the activity of interest.

Reports serve as a good source of record for audit requests and can even be used for sample selection from a population of events. If you use reports for audit activities, you may be asked to trace report data back to the original log file to ensure the data is complete and accurate. You can also clone and modify reports to accommodate requests or assign them to reporting packages to meet the needs of a given audience.

Reporting Packages

LogRhythm administrators can easily create or modify reporting packages to provide needed content for auditors, executive management, or other audiences who require output for assessment. Within the KSA-ECC module, there are four (4) reporting package templates that you can modify to align with auditing and organizational requirements.

 To create a new Reporting Package to be used at your discretion:

1. On the main toolbar, click the Report Center.
2. Click the Report Packages tab.
3. Right-click the grid and click New Report Package.
4. Within the Select Reports window, select the CCF reports you want to include in this reporting package, and then click Next.

5. Click Next on the Override Log Source Criteria without making any changes.

   Do not override log source criteria.

6. Select the frequency for which the reporting package will be produced and the timeframe.
7. Configure additional settings for report delivery options, and then click Next.
8. Add the name and description of the new ECC reporting package, and then click OK.

To create a cloned Reporting Package to apply the CCF Log Source List:

1. On the main toolbar, click the Report Center.
2. Click the Report Packages tab.
3. Right-click on the reporting package you want, and then click Clone.
4. Ensure the correct reports are selected within the reporting package.
5. Click Next until you reach the Override Log Source Criteria.
6. Select Selected Log Source List and type CCF in the Name search field.
7. Select the CCF: All Log Sources check box.
8. Select Next until you reach Package Details, and then change the Package Name.
9. Set Report Package Permissions, and then click OK or Apply to save.