Report Delivery
The Notifications tab of a Report works in the same way as it does for an Analytic Rule, with the same two destination types and the same limit settings. The difference is what gets delivered. A rule delivers a detection, whereas a report delivers the file it produced.
A report can have several notifications, so the same report can be emailed to a distribution list and written to a feed for retention at the same time.
Email Delivery
The report is sent as an attachment, with the subject and body rendered from the notification’s templates.
Where the report is a CSV or TSV and an AI summary was produced, the summary is attached as a second file rather than being packed into an archive, so the recipient does not have to unpack anything.
The file name is derived from the report name and the effective execution time, so a recipient who keeps several editions can tell them apart.
Template Context
Report email templates use the same Jinja syntax as rule detection templates but have a completely different set of variables available, because a report is not a detection.
| Variable | Description |
|---|---|
reportName |
The name of the Report . |
description |
The content of the report’s Documentation tab. |
executionTime |
The wall clock time at which the report ran. |
effectiveExecutionTime |
The point in time the report covers. |
rowCount |
The number of rows in the report. |
fileType |
The format of the attached file. |
fileName |
The name of the attached file. |
aiSummary |
The AI summary, or an empty string where there is none. |
aiSummary is always present so that a template using it renders whether or not a summary was produced.
Note
detectTime, headline or values, are available to a report template.
A template written for an Analytic Rule will not work on a Report.
See Also
Feed Delivery
A Stream notification writes the report into a
Feed
Feed
Report.
The stream carries the report file itself, unchanged, so anything already reading those streams is unaffected by settings such as the AI summary.
The following entries are written to the stream
Metadata
Metadata
| Meta Key | Description |
|---|---|
ReportName |
The name of the report. |
ReportDescription |
The content of the report’s Documentation tab. |
ExecutionTime |
The wall clock time at which the report ran. |
EffectiveExecutionTime |
The point in time the report covers. |
ReportAiSummary |
The AI summary, where one was produced. |
Writing reports to a feed is how you retain a record of what was reported and when, independently of whoever received the email.
Note
Limiting
The Limit Notifications, Maximum Notifications and Resume Notifications After settings behave exactly as they do for an Analytic Rule.
They are far less likely to matter for a report, because a report produces one file per run rather than one notification per matching row.