As an administrator or controller, you may need to run the same Symantec Advanced Threat Protection (ATP) report on a regular basis and distribute it to one or more individuals. You can schedule a report to run automatically on a daily, weekly, or monthly interval. When you schedule a report, you can choose to email a PDF copy of it to yourself and to other recipients. (These recipients only need a valid email address; they do not need to be part of your organization.) As a recipient, you receive the report as an attachment in email shortly after the report runs. The email includes a link to ATP Manager where you can also download the report.
You cannot schedule an Exports Report from the Reports page in ATP Manager. You can only view and download them.
In ATP Manager, you can schedule a report to run at any time. For performance reasons, it is recommended that you schedule reports to run in off-peak hours. You specify the time at which you want the report to run in Coordinated Universal Time (UTC). So, for example, if you want the report to run at 1:00 A.M. EST, you specify 6:00 A.M. UTC (depending on Daylight Savings Time).
You can create more than one schedule for the same report as long as you specify a different name for each schedule. For example, as a controller, you may want to run the Executive Report for yourself on a weekly basis, but for a wider group of recipients on a monthly basis. In this example, you can name the first report Executive Report Weekly, and the second report Executive Report Monthly.
You can also schedule multiple reports to run at the same time. Reports that are scheduled to run at the same time are queued to run one at a time, so may not run at the exact time you specify.
To schedule a report
In ATP Manager, click Reports.
On the Reports screen, hover over the report that you want to schedule, and then click Schedule.
On the report's dialog box, complete the following:
Type a name for this schedule.
If you are running the Incident Details Report, type the incident number for which you want to run the report.
From the drop-down menu, select the frequency for which you want this report to run.
Select one or more days of the week on which you want this report to run.
Enter the day of the month on which you want this report to run.
From the drop-down menu, select the UTC time (listed in 15-minute intervals) at which you want this report to run.
This time is used for each day of the week that you specify when creating a weekly schedule.
Type the email addresses of the recipients to whom you want to send a copy of this report. Separate multiple email addresses with a semicolon (;).
Your email address automatically appears in this field. However, you can delete it.
Some SMTP servers limit the number of emails that a user can send per day, or the number of recipients per message. As such, you may want to restrict the number of recipients, or use an email distribution list instead.
Viewing and deleting report schedules
In ATP Manager, you can view your current report schedules. The Schedules section lists the schedules in the order in which you created them, and includes the following information:
The name of the schedule
The individual who created the schedule
The frequency (Monthly, Weekly, or Daily) and UTC time on which the report runs
The email addresses of the recipients to whom the completed report is sent. Multiple recipients are listed in a drop-down menu
You cannot edit a schedule after you create it. As an administrator or controller, you must delete and recreate a schedule to change it. When you do so, its completed reports are not deleted with it. Additionally, the report completes if it is running (or queued to run) at the time you delete its schedule.
To delete a report schedule
In ATP Manager, click Reports.
On the Reports screen, hover over the report, and then click View.
Under Schedules, hover over the report schedule that you want to delete, and then click the Delete icon.