Working with reports

Reports in Kaspersky Security Center contain information about the status of managed devices. Reports are generated based on information stored on Administration Server. You can create reports for the following types of objects:

• For device selections created according to specific settings.
• For administration groups.
• For specific devices from different administration groups.
• For all devices on the network (in the deployment report).

The application has a selection of standard report templates. It is also possible to create custom report templates. Reports are displayed in the main application window, in the Administration Server folder in the console tree.

Creating a report template

To create a report template:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. Click the New report template button.

The New Report Template Wizard starts. Follow the instructions of the Wizard.

After the Wizard finishes its operation, the newly created report template is added to the selected Administration Server folder in the console tree. You can use this template for generating and viewing reports.

Viewing and editing report template properties

Expand all | Collapse all

You can view and edit basic properties of a report template, for example, the report template name or the fields displayed in the report.

To view and edit properties of a report template:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. In the list of report templates, select the required report template.
4. In the context menu of the selected report template, select Properties.

   As an alternative, you can first generate the report, and then click either the Open report template properties button or the Configure report columns button.

5. In the window that opens, edit the report template properties. Properties of each report may contain only some of the sections described below.
   • General section:
     • Report template name
     • Maximum number of entries to display

       If this option is enabled, the number of entries displayed in the table with detailed report data does not exceed the specified value.

       Report entries are first sorted according to the rules specified in the Fields → Details fields section of the report template properties, and then only the first of the resulting entries are kept. The heading of the table with detailed report data shows the displayed number of entries and the total available number of entries that match other report template settings.

       If this option is disabled, the table with detailed report data displays all available entries. We do not recommend that you disable this option. Limiting the number of displayed report entries reduces the load on the database management system (DBMS) and reduces the time required for generating and exporting the report. Some of the reports contain too many entries. If this is the case, you may find it difficult to read and analyze them all. Also, your device may run out of memory while generating such a report and, consequently, you will not be able to view the report.

       By default, this option is enabled. The default value is 1000.

     • Print version

       The report output is optimized for printing: space characters are added between some values for better visibility.

       By default, this option is enabled.

   • Fields section.

     Select the fields that will be displayed in the report, and the order of these fields, and configure whether the information in the report must be sorted and filtered by each of the fields.

   • Time interval section.

     Modify the report period. Available values are as follows:

     • Between the two specified dates
     • From the specified date to the report creation date
     • From the report creation date, minus the specified number of days, to the report creation date
   • Group, Device selection, or Devices section.

     Change the set of client devices for which the report creates. Only one of these sections may be present, depending on the settings specified during the report template creation.

   • Settings section.

     Change the settings of the report. The exact set of settings depends on the specific report.

   • Security section. Inherit settings from Administration Server

     If this option is enabled, security settings of the report are inherited from the Administration Server.

     If this option is disabled, you can configure security settings for the report. You can assign a role to a user or a group of users or assign permissions to a user or a group of users, as applied to the report.

     By default, this option is enabled.

     The Security section is available if the Display security settings sections check box is selected in the interface settings window.

   • Hierarchy of Administration Servers section:
     • Include data from secondary and virtual Administration Servers

       If this option is enabled, the report includes the information from the secondary and virtual Administration Servers that are subordinate to the Administration Server for which the report template is created.

       Disable this option if you want to view data only from the current Administration Server.

       By default, this option is enabled.

     • Up to nesting level

       The report includes data from secondary and virtual Administration Servers that are located under the current Administration Server on a nesting level that is less than or equal to the specified value.

       The default value is 1. You may want to change this value if you have to retrieve information from secondary Administration Servers located at lower levels in the tree.

     • Data wait interval (min)

       Before generating the report, the Administration Server for which the report template is created waits for data from secondary Administration Servers during the specified number of minutes. If no data is received from a secondary Administration Server at the end of this period, the report runs anyway. Instead of the actual data, the report shows data taken from the cache (if the Cache data from secondary Administration Servers option is enabled), or N/A (not available) otherwise.

       The default value is 5 (minutes).

     • Cache data from secondary Administration Servers

       Secondary Administration Servers regularly transfer data to the Administration Server for which the report template is created. There, the transferred data is stored in the cache.

       If the current Administration Server cannot receive data from a secondary Administration Server while generating the report, the report shows data taken from the cache. The date when the data was transferred to the cache is also displayed.

       Enabling this option allows you to view the information from secondary Administration Servers even if the up-to-date data cannot be retrieved. However, the displayed data can be obsolete.

       By default, this option is disabled.

     • Cache update frequency (h)

       Secondary Administration Servers at regular intervals transfer data to the Administration Server for which the report template is created. You can specify this period in hours. If you specify 0 hours, data is transferred only when the report is generated.

       The default value is 0.

     • Transfer detailed information from secondary Administration Servers

       In the generated report, the table with detailed report data includes data from secondary Administration Servers of the Administration Server for which the report template is created.

       Enabling this option slows the report generation and increases traffic between Administration Servers. However, you can view all data in one report.

       Instead of enabling this option, you may want to analyze detailed report data to detect a faulty secondary Administration Server, and then generate the same report only for that faulty Administration Server.

       By default, this option is disabled.

Extended filter format in report templates

In Kaspersky Security Center 13.1, you can apply the extended filter format to a report template. The extended filter format provides more flexibility in comparison with the default format. You can create complex filtering conditions by using a set of filters, which will be applied to the report by means of the OR logical operator during report creation, as shown below:

Filter[1](Field[1] AND Field[2]... AND Field[n]) OR Filter[2](Field[1] AND Field[2]... AND Field[n]) OR... Filter[n](Field[1] AND Field[2]... AND Field[n])

Additionally, with the extended filter format you can set a time interval value in a relative time format (for example, by using a "For last N days" condition) for specific fields in a filter. The availability and the set of time interval conditions depend on the type of the report template.

Converting the filter into the extended format

The extended filter format for report templates is supported only in Kaspersky Security Center 12 and later versions. After conversion of the default filter into the extended format, the report template becomes incompatible with Administration Servers on your network that have earlier versions of Kaspersky Security Center installed. Information from these Administration Servers will not be received for the report.

To convert the report template default filter into the extended format:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. In the list of report templates, select the required report template.
4. In the context menu of the selected report template, select Properties.
5. In the properties window that opens, select the Fields section.
6. In the Details fields tab click the Convert filter link.
7. In the window that opens, click the OK button.

   Conversion into the extended filter format is irreversible for the report template to which it is applied. If you clicked the Convert filter link accidentally, you can cancel the changes by clicking the Cancel button in the report template properties window.

8. To apply the changes, close the report template properties window by clicking the OK button.

   When the report template properties window opens again, the newly available Filters section is displayed. In this section you can configure the extended filter.

Page top

Configuring the extended filter

To configure the extended filter in the report template properties:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. In the list of report templates, select the report template that was previously converted to extended filter format.
4. In the context menu of the selected report template, select Properties.
5. In the properties window that opens, select the Filters section.

   The Filters section is not displayed if the report template was not previously converted to extended filter format.

   In the Filters section of the report template properties window you can review and modify the list of filters applied to the report. Each filter in the list has a unique name and represents a set of filters for corresponding fields in the report.

6. Open the filter settings window in one of the following ways:
   • To create a new filter, click the Add button.
   • To modify the existing filter, select the required filter and click the Modify button.
7. In the window that opens, select and specify the values of the required fields of the filter.
8. Click the OK button to save changes and close the window.

   If you are creating a new filter, the filter name must be specified in the Filter name field before clicking the OK button.

9. Close the report template properties window by clicking the OK button.

   The extended filter in the report template is configured. Now you can create reports by using this report template.

Page top

Creating and viewing a report

To create and view a report:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. In the list of report templates, double-click the report template that you need.

   A report for the selected template is displayed.

The report displays the following data:

• The name and type of report, a brief description and the reporting period, as well as information about the group of devices for which the report is generated.
• Graph chart showing the most representative report data.
• Consolidated table with calculated report indicators.
• Table with detailed report data.

Saving a report

To save a created report:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. In the list of report templates, select the report template that you need.
4. In the context menu of the selected report template, select Save.

The Report Saving Wizard starts. Follow the instructions of the Wizard.

After the Wizard finishes, the folder opens to which you have saved the report file.

Creating a report delivery task

Reports can be emailed. Delivery of reports in Kaspersky Security Center is carried out using the report delivery task.

To create a delivery task for a single report:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. In the list of report templates, select the report template that you need.
4. In the context menu of the selected report template, select Deliver reports.

The Report Delivery Task Creation Wizard starts. Follow the instructions of the Wizard.

To create a delivery task for multiple reports:

1. In the console tree, under the node with the name of the required Administration Server, select the Tasks folder.
2. In the workspace of the Tasks folder, click the Create a task button.

The Add Task Wizard starts. Follow the instructions of the Wizard.

The newly created report delivery task is displayed in the Tasks folder in the console tree.

The report delivery task is created automatically if the email settings were specified during Kaspersky Security Center installation.

Step 1. Selecting the task type

In the Select the task type window, in the list of tasks select Deliver reports as the task type.

Click Next to proceed to the next step.

Step 2. Selecting the report type

In the Select report type window, in the list of task creation templates, select the type of report.

Click Next to proceed to the next step.

Step 3. Actions on a report

Expand all | Collapse all

In the Action to apply to reports window, specify the following settings:

• Send reports by email

  If this option is enabled, the application sends generated reports by email.

  You can configure the report sending by email by clicking the Email notification settings link. The link is available if this option is enabled.

  If this option is disabled, the application saves reports in the specified folder to store them.

  By default, this option is disabled.

• Save reports to shared folder

  If this option is enabled, the application saves reports to the folder that is specified in the field under the check box. To save reports to a shared folder, specify the UNC path to the folder. In this case, in the Selecting an account to run the task window, you must specify the user account and password for accessing this folder.

  If this option is disabled, the application does not save reports to the folder and sends them by email instead.

  By default, this option is disabled.

• Overwrite older reports of the same type

  If this option is enabled, the new report file at each task startup overwrites the file that was saved in the reports folder at the previous task startup.

  If this option is disabled, report files will not be overwritten. A new report file is stored in the reports folder at each task run.

  This check box is available, if the Save report to folder is selected.

  By default, this option is disabled.

• Specify account for access to shared folder

  If this option is enabled, you can specify the account under which the report will be saved to the folder. If a UNC path to a shared folder is specified as the Save report to folder setting in the Action to be applied to report window, you must specify the user account and password for accessing this folder.

  If this option is disabled, the report is saved to the folder under the account of Administration Server.

  The check box is available, if the Save report to folder is selected.

  By default, this option is disabled.

Click Next to proceed to the next step.

Step 4. Selecting the account to start the task

Expand all | Collapse all

In the Selecting an account to run the task window, you can specify which account to use when running the task. Select one of the following options:

• Default account

  The task will be run under the same account as the application that performs this task.

  By default, this option is selected.

• Specify account

  Fill in the Account and Password fields to specify the details of an account under which the task is run. The account must have sufficient rights for this task.

  • Account

    Account under which the task is run.

  • Password

    Password of the account under which the task will be run.

Click Next to proceed to the next step.

Step 5. Configuring a task schedule

Expand all | Collapse all

On the Configure task schedule Wizard page, you can create a schedule for task start. If necessary, define the following settings:

• Scheduled start:

  Select the schedule according to which the task runs, and configure the selected schedule.

  • Every N hours

    The task runs regularly, with the specified interval in hours, starting from the specified date and time.

    By default, the task runs every six hours, starting from the current system date and time.

  • Every N days

    The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.

    By default, the task runs every day, starting from the current system date and time.

  • Every N weeks

    The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.

    By default, the task runs every Monday at the current system time.

  • Every N minutes

    The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.

    By default, the task runs every 30 minutes, starting from the current system time.

  • Daily (daylight saving time is not supported)

    The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.

    We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.

    By default, the task starts every day at the current system time.

  • Weekly

    The task runs every week on the specified day and at the specified time.

  • By days of week

    The task runs regularly, on the specified days of week, at the specified time.

    By default, the task runs every Friday at 6:00:00 PM.

  • Monthly

    The task runs regularly, on the specified day of the month, at the specified time.

    In months that lack the specified day, the task runs on the last day.

    By default, the task runs on the first day of each month, at the current system time.

  • Manually

    The task does not run automatically. You can only start it manually.

    By default, this option is enabled.

  • Every month on specified days of selected weeks

    The task runs regularly, on the specified days of each month, at the specified time.

    By default, no days of month are selected; the default start time is 6:00:00 PM.

  • On virus outbreak

    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:

    • Anti-virus for workstations and file servers
    • Anti-virus for perimeter defense
    • Anti-virus for mail systems

    By default, all application types are selected.

    You may want to run different tasks depending on the anti-virus application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.

  • On completing another task

    The current task starts after another task completes. You can select how the previous task must complete (successfully or with error) to trigger the start of the current task. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task.

• Run missed tasks

  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.

  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.

  If this option is disabled, only scheduled tasks run on client devices; for Manually, Once and Immediately, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.

  By default, this option is enabled.

• Use automatically randomized delay for task starts

  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.

  If this option is disabled, the task starts on client devices according to the schedule.

• Use randomized delay for task starts within an interval of (min)

  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

  If this option is disabled, the task starts on client devices according to the schedule.

  By default, this option is disabled. The default time interval is one minute.

Page top

Step 6. Defining the task name

In the Define the task name window, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).

Click Next to proceed to the next step.

Step 7. Completing creation of the task

In the Finish task creation window, click the Finish button to finish the wizard.

If you want the task to start as soon as the wizard finishes, select the Run the task after the Wizard finishes check box.