Reporting

The three reporting surfaces

ThreatAware offers three layered approaches to reporting:

Surface	Audience	Refresh	Format
Dashboard	Inside-the-product visibility	Live	Interactive
Scheduled Reports	Email-delivered to a list	Daily, weekly, monthly, quarterly, biannual or yearly	CSV, JSON or Excel
Reporting (AI-built apps)	Custom apps + PDF generation	Live (apps) or on-demand (PDFs)	Interactive apps, exportable PDFs

Pick the surface that matches the audience: leadership wants Reporting dashboards and scheduled PDF; the security ops team wants the Dashboard left open on a screen; auditors want scheduled XLSX deliveries.

Dashboard

Dashboard covers the layout. Use it for:

Daily standup background — leave the Overall Control Health trend visible
NOC / SOC big-screen — Integration Control panel as a wall display
Leadership walkthroughs — Estate Summary + Actions Summary tells the story without a slide

The Dashboard refreshes continuously. There’s nothing to schedule — opening the page shows current state.

Scheduled Reports

Settings → Scheduled Reports is where you set up recurring email deliveries.

How it works

Every scheduled report references a Saved View (built in Devices, Users, Software, or Issues). At each scheduled time, the report exports the current contents of that view and emails the file.

Setting	Options
Name	The saved view to send. The report takes its name
Description	Optional
Format	CSV, JSON or Excel
Frequency	Daily, Weekly, Monthly, Quarterly, Biannual or Yearly, then the day and hour
Recipients	ThreatAware users or external email addresses

Each report card shows its format, how many recipients it has and how often it runs, with Edit, Run now (send it straight away) and Saved View (open the view behind it).

Previously generated reports

Below the live schedules, PREVIOUSLY GENERATED REPORTS shows every past delivery with a Download button. Useful when:

Recipient lost the email
An auditor wants a specific historic snapshot
You need to compare period-over-period

Reports are retained per your tenant’s retention policy.

Limitations

Scheduled reports are point-in-time snapshots. They contain the data at the moment of generation — not a live link to the view. For real-time data, point users at the saved view in the product or build a Reporting app.

Max 100,000 rows per report. Large exports may also hit email-provider attachment limits (typically 25 MB). Either split by tag or use the API for large exports.

Reporting (AI-powered apps)

Reporting is the deepest layer: custom dashboards and tools you build by describing them to the AI Composer. Open it from the left rail (palette icon). Use it when:

The Dashboard doesn’t show what you need
Scheduled CSV/JSON isn’t interactive enough
You want stakeholders to consume reports in-product, not via email
You need PDF generation with custom branding
You want to build internal tools beyond reporting (wizards, validation forms, lifecycle tools)

Reporting page in Build mode showing published apps such as OS Build Environment, License Optimization Dashboard, IT Helpdesk Tools and MITRE Coverage, and a Gallery with Blank Canvas Dark and Blank Canvas Light

View and Build

Switch between the two at the top of the page:

View lists published apps to open. Click Launch App to use one.
Build shows the same apps for editing, plus a Gallery of templates to start a new app from, such as Blank Canvas Dark and Blank Canvas Light.

Filter the list to All, Only Me or Everyone. In Build, hover over an app for Edit and Launch, and use its ⋮ menu to open it in a new tab, copy a link, select, migrate, export, clone, unpublish or delete it. The pin button adds it to the left rail. + New starts an app from scratch, and the ⋮ beside it has Import. The apps you see are the ones your organisation has built; there’s no fixed set. Clone one to start a customised version.

The editor

Area	Purpose
Preview (left)	A live view of the app with your real data. Above it: refresh, to see the code, full screen, and a ⋮ menu
Composer (right)	The AI chat where you describe what to build. It shows how many credits you’ve used
Bottom bar	Data sources, the app’s status and Publish

Building with natural language

The Composer accepts conversational prompts. Build incrementally — one change per prompt.

Start with structure
Add visualisation
Add KPIs
Add interactivity
Refine styling

Create a dashboard showing our security posture.
Add a large metric card at the top showing total devices.

Below the metric, add a donut chart showing devices grouped by manufacturer.
Show percentages on the chart and sort by count, largest first.

Add three metric cards in a row showing:
Devices with healthy EDR
Devices encrypted
Devices with critical issues

Add a dropdown filter at the top right to filter by department tag.
Add a search box to filter the device table.

Use our corporate colours: primary #16A34A, secondary #07C983.
Make the metric cards larger with bold numbers.

What the AI can and can’t see

Reporting uses a privacy-by-design model:

The AI sees schema — field names and types (deviceName: string, lastOnline: timestamp)

The AI sees your prompts — what you describe wanting

The AI sees the code it’s writing

The AI does not see actual data values — never your device names, user emails, IP addresses, or any field contents. When the app runs in preview, ThreatAware executes the AI-generated code against your data on your side. The AI only sees the structure.

The schema is configurable at Settings → Schemas — Device Data and User Data have X-Ray views showing exactly what the AI sees.

Publishing and pinning

Click Publish to make an app available. The visibility next to the app’s name, such as Everyone, decides who sees it. Change it before you publish: once an app is published, unpublish it (⋮ next to Publish) to change the visibility. To add an app to the left rail, click its pin button in Build. Pinned apps sit alongside Devices, Issues and Action Center.

PDF generation

In the editor, open the ⋮ menu above the preview and choose Generate PDF:

A4 Portrait or A3 Portrait, to create a PDF now
Schedule…, to send one regularly

Use this for board-deck appendices, audit submissions, and MSP client deliverables.

Editing safely

Test in Build mode, publish when ready

Edits stay in Build mode until you Publish. The Published version stays live until promoted.

Use Restore Checkpoint

If you make a mistake, restore the last published version. The Composer logs every checkpoint.

Duplicate before major changes

For risky redesigns, clone the app first (“App v2”), iterate there, then replace the original when ready.

Document changes in description

Add changelog entries in the app’s description so future maintainers understand evolution.

Code ownership

Every app’s code is yours:

The AI writes React and TypeScript code
Click above the preview to see it
Export the app from ⋮ → Advanced → Export, and bring one in with Import on the Reporting page

Reporting gives you working code, not a black box.

Example: weekly executive summary

Build me an executive summary dashboard.

Top: title "Weekly Security Summary" with the current date.

Three KPI cards in a row:
  1. EDR coverage % across End-User devices
  2. MFA enrolment % across all users
  3. Critical issues count

Below: a line chart of overall posture % over the last 30 days.

Below that: a table of the top 10 devices by issue count,
columns: Device Name, User, Last Online, Issue Count.

Use my corporate colours: primary #16A34A.

Iterate on layout, colours and wording with follow-up prompts, then publish it, pin it, and schedule a weekly PDF from Generate PDF → Schedule….

Common report patterns

Coverage gap
Broken agents
Compliance scorecard
OS migration tracker
MSP client deliverable

Question: which devices don’t have a required control?

In Devices, query: tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false
Save view as “End-User Devices Missing CrowdStrike”
Schedule: Weekly CSV to security-ops@company.com, Monday 8am
Pair with a Tracked View and an Action Center flow on the same query for automated remediation

Question: which agents are deployed but not functioning?

Query: (system.crowdstrike.deployed:true AND system.crowdstrike.functioning:false) OR (system.microsoft_defender_atp.deployed:true AND system.microsoft_defender_atp.functioning:false)
Save view as “Broken Security Agents”
Schedule: Daily CSV to soc@company.com, weekday mornings
Why it works: ThreatAware computes the not-functioning state from cross-tool comparison — the single-tool console cannot

Question: what % of devices are fully compliant against our baseline?

Build the query that captures compliant devices (tags:End-User AND system.crowdstrike.deployed:true AND system.crowdstrike.functioning:true AND system.microsoft_intune.deployed:true AND ...)
Save view as “End-User Compliant”
Build a Reporting app that surfaces the percentage with a gauge + trend
Schedule: Reporting PDF export via the app’s Generate PDF — Monthly to leadership

Question: monthly compliance report for Client Acme

Build views filtered by tags:Acme
Reporting app with company branding (Acme logo, colours) showing key metrics
PDF export, scheduled monthly
Send via the Reporting app’s Schedule feature (where available) or via an outbound automation that pulls the saved view XLSX

Export formats

Format	Best for
CSV	Excel analysis, BI tool import, sharing with stakeholders
JSON	Programmatic processing, scripts, data warehouse ingest
Excel	Direct Excel consumption with formatting preserved
PDF (via Reporting)	Executive presentations, audit deliverables

Audience-tailored cadence

A working rhythm that scales:

Audience	Cadence	Channel	Format
SOC analysts	Daily	Email + screen	CSV / Dashboard
Department IT leads	Weekly	Email	XLSX
CISO / leadership	Monthly	Email + meeting	PDF (Reporting)
Board	Quarterly	Meeting + appendix	PDF (Reporting)
Auditor	On-demand	Email	XLSX + audit log export
MSP client	Monthly	Email	PDF (Reporting with branding)

Best practices

Schedule at useful times

Mondays at 8am for operational teams. First-of-the-month for management. Avoid Friday evening (no one reads them).

Keep recipient lists tight

A daily report to 30 people is a daily delete to 28 people. Right person, right cadence.

Document the report owner

In the report description, name the human responsible for the underlying view. When metrics change unexpectedly, recipients know who to ask.

Archive auditor-relevant reports

Monthly compliance reports should be saved to a long-retention bucket. The Settings → Scheduled Reports previously-generated list is a convenience, not a compliance archive.

Pair every scheduled report with a Tracked View

If a report has been listing the same 12 devices for three months, the problem isn’t visibility: no one is acting. Track the same view, and use Action Center to alert the owners.

Cross-references

Settings → Scheduled Reports

The admin page

Settings → Schemas

What the AI can see

Devices

Where saved views are built

Action Center

Pair every report with an action

Get started

Inventory

Tags, Logic & Coverage

Vitals & Issues

Action Center

Integrations

Access & Admin

Reference

Trust & Security

Reporting

The three reporting surfaces

Dashboard

Scheduled Reports

How it works

Previously generated reports

Limitations

Reporting (AI-powered apps)

View and Build

The editor

Building with natural language

What the AI can and can’t see

Publishing and pinning

PDF generation

Editing safely

Code ownership

Example: weekly executive summary

Common report patterns

Export formats

Audience-tailored cadence

Best practices

Cross-references

Settings → Scheduled Reports

Settings → Schemas

Devices

Action Center

​The three reporting surfaces

​Dashboard

​Scheduled Reports

​How it works

​Previously generated reports

​Limitations

​Reporting (AI-powered apps)

​View and Build

​The editor

​Building with natural language

​What the AI can and can’t see

​Publishing and pinning

​PDF generation

​Editing safely

​Code ownership

​Example: weekly executive summary

​Common report patterns

​Export formats

​Audience-tailored cadence

​Best practices

​Cross-references

Settings → Scheduled Reports

Settings → Schemas

Devices

Action Center

The three reporting surfaces

Dashboard

Scheduled Reports

How it works

Previously generated reports

Limitations

Reporting (AI-powered apps)

View and Build

The editor

Building with natural language

What the AI can and can’t see

Publishing and pinning

PDF generation

Editing safely

Code ownership

Example: weekly executive summary

Common report patterns

Export formats

Audience-tailored cadence

Best practices

Cross-references