Exporting Report Data

Updated 3 months ago by Elvis Hovor

Exporting a Report

You can export any report to your local machine. This downloads a file containing the IOCs from your selected report and all data sources from the graph including intelligence sources, correlated reports, and community reports.

Formats supported for export include:

  • JSON
  • STIX
  • TXT
  • FireEye TAP
You must be in Reports Graph View to see the Export options and download a report.

To export a report:

  1. Click the three dots at the top of the Details pane (left side of Constellation View). This displays a dropdown menu.
  2. Choose the export options you want to use.

The file is immediately downloaded to your local machine.

File Formats

This section explains each of the download formats for data export.

JSON

Data Exported

  • Report ID: Unique identifier generated by the platform for each report
  • Creation timestamp: indicating when the platform created the report
  • Report title
  • timeBegan timestamp: this is the time provided by the user when submitting a report. If user doesn't provide a time the Creation timestamp is used.
  • Status showing if report has been fully Processed
  • Report body
  • Submission source (API or Web)
  • List of extracted IOCs with type and value of each IOC

Example: report-ab7f60fa-0f11-4ebf-baf5-bed8dc0005fd.json

STIX

Data exported:

  • STIX_PACKAGE
  • Report description

Example: report-ab7f60fa-0f11-4ebf-baf5-bed8dc0005fd.xml

TXT

Data exported:

  • Report title
  • IOCs extracted
  • Correlated intel

Example: report-ab7f60fa-0f11-4ebf-baf5-bed8dc0005fd.txt

FIREEYE TAP

Data exported:

  • Report ID
  • IOCs extracted
  • IOC type
  • Risk

Example: report-ab7f60fa-0f11-4ebf-baf5-bed8dc0005fd.csv


How Did We Do?