How to Create a Policy Using the Wizard - Local Reporting Options

This topic describes how to use the Create Policy settings on the Local Reporting Options page. These settings control report options, paths to configuration files, where to store search results, and other reporting options.

After completing the Additional Settings page of the Create Policy wizard, click Next to proceed to the Additional Settings page to input more detailed options.

Local Reporting Options

Use the table below to help you fill in the Local Reporting page.

Local Reporting settings control report options, paths to configuration files, where to store search results, and other reporting options.

Setting Name

Options

Description

Exit on Complete

  • Do not exit (0) (Default)
  • Always exit (1)
  • Only exit when no results (2)

By default, when the endpoint application is executed as a scheduled task in the context of the logged on user, it remains open and enables the user to interact with those results.

  • Do not exit - Default. Do not automatically exit the application upon completion of a scheduled task search
  • Always exit - Always automatically exit the application upon completion of a scheduled task search
  • Only exit when no results - Only automatically exit the application when there are no results

Save Key

  • Enter the encrypted password

Specify the encrypted password to be used when automatically saving an IDF results file

Note: This value must be created using the endpoint GUI.

Reference documentation is available at Creating a Password Hash for Auto Saving Results During Scheduled Task Searches

Save Key 2

  • Enter the encrypted password

Specify the encrypted password to use when automatically saving a secondary IDF results file

Note: This value must be created using the endpoint GUI.

Reference documentation is available at Creating a Password Hash for Auto Saving Results During Scheduled Task Searches

Save Location

  • Enter the folder path and file name for the saved IDF file

The folder path and file name for the saved IDF file.

  • Specify the full folder path and file name for the saved results file
  • To specify a folder name only, the setting Save Location Is Folder Name must be set to "True"

Save Location 2

  • Enter the folder path and file name for the secondary saved IDF file

The folder path and file name for the secondary saved IDF file.

  • Specify the full folder path and file name for a secondary saved results (IDF) file
  • To specify a folder name only, the setting Save Location Is Folder Name must be set to "True"

Save Locations Are Folder Names

  • False (0) (Default)
  • True (1)

Specify that the settings Save Folder Location and Save Folder Location 2 are folder names rather than file names.

  • False - Treat the locations in the settings Save Location and Save Location 2 as full paths to specific file names
  • True - Treats the locations in the settings Save Location and Save Location 2 as folders rather than full paths to specific file names. The endpoint application automatically creates new names for the saved results files based on the source machine name in addition to a time stamp.

Settings Source

  • Profile (0) (Default)
  • JobSettings (1)
  • Configuration file (2)

Specify the location of the settings for the scheduled task.

  • Settings for a scheduled task can be read from any of the following:
    • A user profile (Profile)
    • An alternate registry-based location (JobSettings)
    • Configuration file
  • In all instances, the hierarchy of system settings and overrides is respected

Auto Save Results

  • Disable
  • Save as IDF
  • Save as HTML
  • Save as CSV

Enable the ability to automatically save search results.

  • Disable - Do not automatically save search results.
  • Save as IDF - Automatically save results to an IDF file upon search completion
  • Save as HTML - Automatically save results to an HTML file upon search completion
  • Save as CSV - Automatically save results to an CSV file upon search completion

Note: In Version 7.0.x of the endpoint software, this setting only applies to interactive, user searches and cannot be used with background user searches or system searches. This was updated in version 7.1 to apply to all search types.

Auto Save Secure Results 2

  • Disable (0) (Default)
  • Enable (1)

Enable the ability to automatically save results to a secondary file of type IDF.

  • Disable - Default. Do not automatically save results to an additional file (only type IDF) upon search completion
  • Enable - Automatically save results to an additional file (only type IDF) upon search completion

Note: In Version 7.0.x of the endpoint software, this setting only applies to interactive, user searches and cannot be used with background user searches or system searches. This was updated in version 7.1 to apply to all search types.

Configuration File Location

  • Path to a configuration file

Specify the path to a configuration file

  • Specify the full path to a configuration file in XML format that holds the settings to be used for the scheduled task.
  • This setting is only valid when the setting Settings Source is set to "Configuration File".

* This option is specific to searches initiated from Windows Agent UI. This is a Windows-only option. Mac/Linux are excluded.

Create Folder Location

  • Disable (0) (Default)
  • Enable (1)

Automatically create the folder for the saved results file.

  • Disable - Do not automatically create the folder for saved results file if it does not already exist.
  • Enable - Automatically create the folder for saved results file if it does not already exist.

Create Folder Location 2

  • Disable (0) (Default)
  • Enable (1)

Automatically create the folder for the secondary saved results file

  • Disable - Do not automatically create the folder for the secondary saved results (IDF) file if it does not already exist.
  • Enable - Automatically create the folder for the secondary saved results (IDF) file if it does not already exist.

CSV Report Options

Format: Name/(value)/default/Platform (All/Windows/Mac/Linux)

  • Save Location Type (1) (Default) All platforms
  • Save Location (2) (Default) All platforms
  • Save Match (4) (Default) All platforms
  • Save Data Type (8) (Default) All platforms
  • Save Number of Instances (16) (Default) All platforms
  • Save Checked Rows Only (32) All platforms
  • Save Parent Rows Only (64) All platforms
  • Save Summary Information (128) (Default) All
  • Mask all but the last 4 characters of the match (256) All platforms
  • Save Item Size (512) Windows
  • Save Date Created (1024) Windows
  • Save Date Modified (2048) Windows
  • Save Date Accessed (4096) Windows
  • Save File Owner (8192) Windows
  • Save File Attributes (16384) Windows
  • Mask all but the last 4 characters of the match (and first six for CCNs) (32768) All
  • Save Classification (65536) All
  • Save Database Column Name (131072) All

The elements and options to save in the Text Export.

  • Specify the elements and options to save in the Text Export.
  • When using this setting outside of the console, note that the value for this setting is a bitmask of the logical OR of any of these values.
  • When created in the Windows Registry, they are of type REG_DWORD.
  • When entered into the Windows Registry or a configuration XML file, they should be entered as hexadecimal values.
  • When entered into a security template (.inf) file, they should be entered in decimal.
  • When both "last four" and "last four (and first six for CCNs)" are selected, "last four (and first six for CCNs)" are used.

Description

Value

Default

Save Item Type

0x00000001

On

Save Location

0x00000002

On

Save Match

0x00000004

On

Save Data Type

0x00000008

On

Save Number of Instances

0x00000010

On

Save Checked Rows Only

0x00000020

Off

Save Parent Rows Only

0x00000040

Off

Save Summary Information

0x00000080

N/A

Mask all but the last 4 characters of the match

0x00000100

Off

Save Item Size

0x00000200

Off

Save Date Created

0x00000400

Off

Save Date Modified

0x00000800

Off

Save Date Accessed

0x00001000

Off

Save File Owner

0x00002000

Off

Save File Attributes

0x00004000

Off

Mask all but the last 4 characters of the match (and first 6 for CCNs)

0x00008000

Off

CSV Save Repeat All Data

  • Disable (0) (Default)
  • Enable (1)

Save all information of each row of the Text Export.

  • Enable - Saves all information of each row of the saved Text Export.
  • Disable - Preserves the parent/child layout while a setting of "Enable" repeats all information on all rows.

* This option is specific to Windows and Mac. Linux is excluded.

CSV Save Show Multi Rows

  • Disable (0) (Default)
  • Enable (1)

Save the "Multiple Match" rows in the Text Export

  • To disable the saving of the "Multiple Match" rows, set this value to Disable.

HTML Report Options

Format: Name/(value)/default/Platform (All/Windows/Mac/Linux)

  • Save Location Type (1) All
  • Save Location (2) (Default) All
  • Save Match (4) All
  • Save Data Type (8) (Default) All
  • Save Number of Instances (16) (Default) All
  • Save Checked Rows Only (32) All
  • Save Parent Rows Only (64) All
  • Save Summary Information (128) (Default) All
  • Mask all but the last 4 characters of the match (256) All
  • Save Item Size (512) Windows
  • Save Date Created (1024) Windows
  • Save Date Modified (2048) Windows
  • Save Date Accessed (4096) Windows
  • Save File Owner (8192) Windows
  • Save File Attributes (16384) Windows
  • Mask all but the last 4 characters of the match (and first six for CCNs) (32768) All
  • Save Classification (65536) All
  • Save Database Column Name (131072) All

The elements and options to save in the Web Page Report.

  • Specify the elements and options to save in the Web Page Report (used only when HTML Report Type is set to "Custom Report")
  • When using this setting outside of the console, note that the value for this setting is a bitmask of the logical OR of any of these values
  • When created in the Windows Registry, they are of type REG_DWORD
  • When entered into the Windows Registry or a configuration XML file, they should be entered as hexadecimal values
  • When entered into a security template (.inf) file, they should be entered in decimal
  • When both "last four" and "last four (and first six for CCNs)" are selected, "last four (and first six for CCNs)" are used

Description

Value

Default

Save Item Type

0x00000001

Off

Save Location

0x00000002

On

Save Match

0x00000004

Off

Save Data Type

0x00000008

On

Save Number of Instances

0x00000010

On

Save Checked Rows Only

0x00000020

Off

Save Parent Rows Only

0x00000040

Off

Save Summary Information

0x00000080

On

Mask all but the last 4 characters of the match

0x00000100

Off

Save Item Size

0x00000200

Off

Save Date Created

0x00000400

Off

Save Date Modified

0x00000800

Off

Save Date Accessed

0x00001000

Off

Save File Owner

0x00002000

Off

Save File Attributes

0x00004000

Off

Mask all but the last 4 characters of the match (and first 6 for CCNs)

0x00008000

Off

 

HTML Report Type

  • Complete Report (0) (Default)
  • Executive Summary (1)
  • Custom Report (2)

The options for saved Web Page Report

  • Complete Report - Default. Saved web page report is a complete report
  • Executive Summary - Saved web page report is an executive summary
  • Custom Report - Saved web page report is a custom report

* This option is specific to Windows and Mac. Linux is excluded.

Spirion Report Options

  • Save Match (4) (Default) All platforms
  • Save Checked Rows Only (32) All platforms

The elements and options to save in the Encrypted IDF file.

  • Specify the elements and options to save in the Secure IDF file
  • When Save Match is disabled, some functionality is disabled
  • Notably, the highlight in the Preview pane is incorrect and the Redact action fails
  • When using this setting outside of the console, note that the value for this setting is a bitmask of the logical OR of any of these values
  • When created in the Windows Registry, they are of type REG_DWORD
  • When entered into the Windows Registry or a configuration XML file, they must be entered as hexadecimal values
  • When entered into a security template (.inf) file, they must be entered in decimal

* This option is specific to Windows and Mac. Linux is excluded

Disable Feature - Save Spirion Files

  • Allow save as idf (0) (Default)
  • Disable save as idf (1)

Disable the ability save encrypted IDF results files.

  • Allow save as idf (Default) - Enable the ability to save encrypted IDF results files
  • Disable save as idf - To disable the ability save encrypted IDF results files

* This option is specific to Windows and Mac. Linux is excluded.

Disable Save Feature in Clear Text

  • Allow clear text save (0) (Default)
  • Disable clear text save (1)

Disable the ability to save results in clear text

  • Allow clear text save - Default. Allow users the ability to save results in a format other than encrypted IDF format
  • Disable clear text save - Disable the ability to save results in any format other than encrypted IDF format

* This option is specific to Windows and Mac. Linux is excluded.

Check Previous Results

  • Do not check results (0)
  • Check results (1) (Default)

Automatically check to verify if previous file results exist.

  • Beginning with version 6 of the client, by default, file results that are visible in the UI are automatically encrypted, saved on exit, and automatically displayed in the endpoint UI when a user opens the endpoint interactively and signs into their profile.
  • The save uses a "machine key" to prevent the opening of the results file on another computer.
  • Check results - Verify previous file results exist. When this setting is enabled and the endpoint is configured to communicate with the console, file results are automatically and transparently checked for existence on startup.
    • If the files no longer exist (for example, they were deleted from within Windows Explorer), that information is communicated to the console.
  • Do not check results - Do not verify previous file results exist.

Automatically Save & Load Results

  • Disable (0)
  • Enable (1) (Default)

Enable the automatic saving and loading of search results.

Beginning with version 6 of the client, by default, results that are visible in the UI are automatically encrypted, saved on exit, and automatically displayed in the endpoint UI when a user opens the endpoint interactively and signs into their profile. The save uses a "machine key" to prevent the opening of the results file on another computer.

When the setting "Check Previous Results" is enabled and the endpoint is configured to communicate with the console, file results will be automatically and transparently checked for existence. If the files no longer exist (for example, they were deleted from within Windows Explorer), that information is communicated to the console.

In the endpoint UI, the checkbox for the setting "Display previous search results on startup" enables both this setting and the setting "Show Results in Client UI."

  • Disable - Disables LiveMode. When disabled, other LiveMode settings have no effect, regardless of their values.
  • Enable - Default. Enables LiveMode. Search results are automatically saved and loaded.

Show Results in Client UI

  • Do not show results (0)
  • Show results (1) (Default)

Automatically display previous search results in the endpoint (workstation, laptop, etc.) UI on startup.

  • Beginning with version 6 of the client, by default, results that are visible in the UI are automatically encrypted, saved on exit, and automatically displayed in the endpoint UI when a user opens the endpoint interactively and signs into their profile.
  • The save uses a "machine key" to prevent the opening of the results file on another computer
  • Do not show results - Do not show the previous results in the endpoint UI
  • Show results - Show the previous results in the endpoint UI
  • In the endpoint UI, the checkbox for "Display previous search results on startup" enables both that setting and this setting.

* This option is specific to searches initiated from Windows Agent UI. This is a Windows-only option. Mac/Linux are excluded.

  1. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
    to discard.
  2. See the Local Logging Options page to complete the Local Logging settings.


Was this article helpful?