> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scheduled Reports

> Recurring email exports of saved views — top-level overview

This page is the top-level conceptual view. The configuration UI lives at [Settings → Scheduled Reports](/settings/scheduled-reports).

## The three things a Scheduled Report does

1. **Pull data from a Saved View** at the scheduled moment.
2. **Render in your chosen format** — CSV, JSON, or XLSX.
3. **Email to recipients** — one or more addresses.

That's the whole feature. Everything else is configuration around those three steps.

## Pick the right cadence

| Cadence       | Best for                                                                     |
| ------------- | ---------------------------------------------------------------------------- |
| **Daily**     | Operational reports — broken agent lists, daily issue counts                 |
| **Weekly**    | Team sync points — Monday morning coverage gaps, weekly compliance summaries |
| **Monthly**   | Leadership reporting — first-of-month executive summaries                    |
| **Quarterly** | Board / governance reports                                                   |

Most tenants find a daily-weekly-monthly mix covers most needs. Quarterly is usually too infrequent to spot drift.

## Pick the right format

| Format   | When                                                      |
| -------- | --------------------------------------------------------- |
| **CSV**  | Default. Universal. Excel friendly.                       |
| **JSON** | Programmatic ingest, data warehouse, scripts              |
| **XLSX** | When formatting matters — date columns, currency, headers |

For PDFs and richer visualisations, use [Reporting](/reporting#reporting-ai-powered-apps) instead — apps support PDF generation with custom branding.

## Common patterns

Tabulated by use case:

| Goal                                | Frequency | Format | Underlying view                                                                            |
| ----------------------------------- | --------- | ------ | ------------------------------------------------------------------------------------------ |
| Daily broken-agent triage           | Daily     | CSV    | `system.crowdstrike.deployed:true AND system.crowdstrike.functioning:false`                |
| Weekly EDR coverage to security ops | Weekly    | XLSX   | `tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false` |
| Monthly compliance summary to CISO  | Monthly   | XLSX   | Compliance view filtered by required-controls                                              |
| Quarterly board appendix            | Quarterly | XLSX   | Estate snapshot + KPIs                                                                     |
| MSP client monthly report           | Monthly   | XLSX   | `tags:Client-Acme`, branded                                                                |
| Data warehouse hourly device feed   | Daily     | JSON   | Full device inventory                                                                      |

## Best practices

<AccordionGroup>
  <Accordion title="Time the delivery">
    Match the recipient's working pattern: Monday morning for operational teams, first-business-day for leadership. Avoid Friday evening — no one reads them.
  </Accordion>

  <Accordion title="Tight recipient lists">
    A daily report to 30 people is a daily delete to 28 people. Right person, right cadence.
  </Accordion>

  <Accordion title="Document the owner">
    In the report's name or description, identify the human who owns the underlying saved view. When metrics shift unexpectedly, recipients know who to ask.
  </Accordion>

  <Accordion title="Pair with an Action">
    Reports without ownership become wallpaper. If you're emailing 12 broken devices weekly, you should also have a [Continuous Action](/automation) targeting the same query.
  </Accordion>

  <Accordion title="Archive auditor-relevant reports">
    The PREVIOUSLY GENERATED REPORTS list in Protect is a convenience. For compliance retention, route reports to a shared mailbox that forwards to your audit retention system.
  </Accordion>

  <Accordion title="Test with Run Now before relying on schedule">
    Click **Run now** on a new report to validate the email pipeline before waiting for the scheduled time.
  </Accordion>
</AccordionGroup>

## Limits

Quick summary:

* 100,000 rows per export
* Mail-provider attachment caps (typically 25 MB)
* Switch to CSV or split by tag for large outputs

## See also

<CardGroup cols={3}>
  <Card title="Settings → Scheduled Reports" icon="gear" href="/settings/scheduled-reports">
    The configuration UI
  </Card>

  <Card title="Reporting overview" icon="chart-line" href="/reporting">
    Where scheduled reports fit
  </Card>

  <Card title="Saved Views" icon="floppy-disk" href="/query-language#saved-views">
    Prerequisite
  </Card>
</CardGroup>