The three things a Scheduled Report does
- Pull data from a Saved View at the scheduled moment.
- Render in your chosen format: CSV, JSON or Excel.
- Email to recipients — one or more addresses.
Pick the right cadence
Most organisations find a mix of daily, weekly and monthly covers most needs. Quarterly and longer are too infrequent to spot drift, but suit formal reviews.
Pick the right format
For PDFs and richer visualisations, use Reporting instead — apps support PDF generation with custom branding.
Common patterns
Tabulated by use case:Best practices
Time the delivery
Time the delivery
Match the recipient’s working pattern: Monday morning for operational teams, first-business-day for leadership. Avoid Friday evening — no one reads them.
Tight recipient lists
Tight recipient lists
A daily report to 30 people is a daily delete to 28 people. Right person, right cadence.
Document the owner
Document the owner
In the report’s name or description, identify the human who owns the underlying saved view. When metrics shift unexpectedly, recipients know who to ask.
Pair with an Action
Pair with an Action
Reports without ownership become wallpaper. If you’re emailing the same 12 broken devices every week, track that view too, so someone follows each device to a fix.
Archive auditor-relevant reports
Archive auditor-relevant reports
The PREVIOUSLY GENERATED REPORTS list in ThreatAware is a convenience. For compliance retention, route reports to a shared mailbox that forwards to your audit retention system.
Test with Run Now before relying on schedule
Test with Run Now before relying on schedule
Click Run now on a new report to validate the email pipeline before waiting for the scheduled time.
Limits
Quick summary:- 100,000 rows per export
- Mail-provider attachment caps (typically 25 MB)
- Switch to CSV or split by tag for large outputs
See also
Settings → Scheduled Reports
The configuration UI
Reporting overview
Where scheduled reports fit
Saved Views
Prerequisite