Scan Reports

The Scan Reports feature allows administrators to schedule, customize, and manage summary reports that are sent via email. These reports provide an overview of scan activity, threats detected, policy enforcement, and other metrics for each tenant.

Report List

Admins can view and manage existing reports from the Reports section under Settings.

Search bar: Allows users to filter reports by report name or subject
Report columns:
- Report name: The internal name assigned to the report.
- Subject: The subject line used in the sent email.
- Status: Toggle to activate or deactivate scheduled sending.
Report buttons:
- Delete: Delete icon to permanently remove the report.
- Clone: Clone the report.

Creating a New Report

Click Add new report in the top-right corner.

Choose Report Type

Select Scan Report.

For other report types, see Quarantine Reports.

Report Settings

Each report includes the following configuration options:

Active – Enables or disables the report.
Report name – Internal descriptive name.
Report subject – Subject line of the email.
Email sender – From address for outgoing reports.
Select days of the week – Choose which days the report is sent.
Use custom start date - Choose a custom start date for the first report. If not selected, content processed from the report creation date will be included in the first report.
Time / Time zone – Schedule delivery time.
Recipients – Select users or groups to receive the report.

Editing a Report

Clicking on a report opens the Report Details page, where you can configure general settings and the email content.

Report Settings

Report Name: Internal display name for the report.
Report subject: Subject line used in the report email.
Email Sender: Specifies the sender email address, for example: noreply@mycompany.com.
- The sender field can also include both display name and email address as follows: "Display name" <noreply@mycompany.com>.
Schedule: Choose the days of the week and time for delivery.
Time zone: Define the time zone for scheduled delivery.
Recipients: Users or groups to receive the report.

Email Content Customization

HTML Tab:
- Provides a rich text editor for formatting email content.
- Users can insert fields, format text, add tables, and customize the layout.
Plain Text Tab:
- Used for text-based email clients.

Info

When editing HTML content, the plain text version is automatically updated, based on the content provided.

Email Content Preview

Shows a sample report email with placeholders replaced by actual data.

Scripting Language

It is also possible to additionally customize report templates using the Handlebars template scripting language. For more information see: https://handlebarsjs.com/guide/

Custom Fields

The following field can be inserted into email report templates:

Here's the Scan Report table in the same format.

Category	Name	Description
Report	Date/Time Created	When the report was generated. Apply a formatting helper to control how the date and time appear.
Events	Total	The total number of events in the reporting period, across every channel and outcome.
Events	Closed	Group heading. Events that have been resolved and need no further action.
Events → Closed	Count	How many events were closed.
Events	Deleted	Group heading. Events where the item was permanently removed.
Events → Deleted	Count	How many items were deleted.
Events	Released	Group heading. Events where a quarantined item was released to its recipient.
Events → Released	Count	How many items were released from quarantine.
Events	Sanitized	Group heading. Events where the item was cleaned with Deep CDR and a safe copy delivered in place of the original.
Events → Sanitized	Count	How many items were sanitized.
Events	Investigating	Group heading. Events currently under review, with no final outcome yet.
Events → Investigating	Count	How many events are still being investigated.
Events	Quarantined	Group heading. Events where the item was held in quarantine and not delivered.
Events → Quarantined	Count	How many items were quarantined.
Events	Delivered	Group heading. Events where the item passed policy and reached its recipient.
Events → Delivered	Count	How many items were delivered.
Events	Failed To Deliver	Group heading. Events where delivery was attempted but did not complete.
Events → Failed To Deliver	Count	How many items failed to deliver.
Events	Failed To Analyze	Group heading. Events where the item could not be scanned, for example because it was encrypted, corrupt, or larger than the configured limits.
Events → Failed To Analyze	Count	How many items could not be analyzed.
Blocked	Files	Group heading. The file types blocked most often in the reporting period, as a list — loop over it to show each one.
Blocked → File	Type	A blocked file type. This is the true file type identified during scanning, which can differ from the file extension.
Blocked → File	Count	How many items were blocked because they carried this file type.
Blocked	Recipients	Group heading. The recipients targeted most often by blocked items, as a list — loop over it to show each one.
Blocked → Recipients	Address	Address of a targeted recipient: an email address, or a user principal name for Teams.
Blocked → Recipients	Count	How many items addressed to this recipient were blocked.
Blocked	Senders	Group heading. The senders responsible for the most blocked items, as a list — loop over it to show each one.
Blocked → Senders	Address	Address of a sender: an email address, or a user principal name for Teams.
Blocked → Senders	Count	How many items from this sender were blocked.
Blocked	Channels	Group heading. The Teams conversations with the most blocked items, as a list — loop over it to show each one. Teams only.
Blocked → Channels	Name	Name of the conversation: the topic of a named group chat, or `<team> / <channel>` for a channel post. Empty for one-to-one chats and unnamed group chats.
Blocked → Channels	Count	How many items were blocked in this conversation.
Items	Sanitizations	Group heading. How much content was cleaned by Deep CDR.
Items → Sanitizations	Rate (%)	Files sanitized as a percentage of all files scanned. Matches the sanitization rate shown on the dashboard.
Items → Sanitizations	Count	How many files were sanitized by Deep CDR.
Items	Scans	Group heading. How much of the processed traffic was actually scanned.
Items → Scans	Rate (%)	Items scanned as a percentage of items processed. This falls below 100% when allowlisted content bypassed every security check.
Items → Scans	Count	How many items were processed, across all channels.
Items	Threats	Group heading. How much of the traffic was found to be a threat.
Items → Threats	Rate (%)	Items flagged by any detection technology as a percentage of items processed. Shown as Detection Rate on the dashboard.
Items → Threats	Count	How many items were flagged by any detection technology. Shown as Threats Detected on the dashboard.

Last updated on

Was this page helpful?