Scheduled Report Notification Schema

You can refer to this scheduled report notification schema to configure the payload template for a third-party templated connection.

Schema

Copy

JSON

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
{
  "account_id": "string",
  "artifact_data": {
    "attachments": [
      {
        "name": "string",
        "url": "string"
      }
     ],   
    "create_time": number,
    "metadata": {
      "artifact_create_date": "string",
      "cadence": "string",
      "cid": "string",      
      "customer_name": "string",
      "report_description": "string",
      "report_id": "string",
      "report_type": "string",
      "result_count": number,      
      "schedule_id": "string",      
      "scheduled_report_name": "string"
    },
    "result_count": number,    
    "result_id": "string"      
  },  
  "created": {
    "at": number,
    "by": "string"
  },
  "delete_empty_result": boolean,
  "id": "string",
  "modified": {
   "at": number,
   "by": "string"
   },
  "name": "string",
  "notify_behavior": "string",
  "publish_result": {
    "status": "string",
    "timestamp": number
  },
  "published": boolean,
  "run_once": boolean,
  "schedule": {
    "daily": {
      "hour": number,     
      "minute": number
    },
    "weekly": {
      "day": number,     
      "hour": number,     
      "minute": number
    },
    "monthly": {
      "day": number,     
      "hour": number,     
      "minute": number
    }    
  },
  "schedule_id": "string",
  "scheduled_time": number,
  "status": "string",  
  "type": "string",
  "extra": {
    "artifact_create_date": "string",
    "cadence": "string",
    "cid": "string",
    "customer_name": "string",
    "download_url": "string",
    "report_description": "string",
    "report_id": "string",
    "result_count": "string",
    "schedule_id ": "string",
    "scheduled_report_name": "string",
    "ui_url": "string"
  }
}

Definitions

account_id (string) - Customer account identifier (example: 12345678)

artifact_data (object) - Information about the scheduled report
- attachments (object) - Information used internally to attach the scheduled report to the notification email
  - name (string) - Name of the report schedule with the report generation date appended (example: Daily Variance Report 2022-08-25 21:26 GMT.gz)
  - url (string) - URL to download the report (example: https://api.cloudinsight.alertlogic.com/cargo/v2/12345678/execution_record/20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010/result)
- create_time (number) - Epoch time when the report was generated (example: 1661462780)
- metadata (object) - Information in the email notification sent to the customer when the scheduled report is generated
  - artifact_create_date (string) - Date and time the scheduled report was generated in the format YYYY-MM-DD HH:MM GMT (example: 2022-08-25 21:26 GMT)
  - cadence (string) - Schedule frequency and time when report is scheduled to run in human-readable format (example: Daily, 21:26 GMT)
  - cid (string) - Customer account identifier (example: 12345678). Alert Logic recommends you use account_id instead.
  - customer_name (string) - Customer name of the Alert Logic account where the report was scheduled (example: XYZ Corporation)
  - report_description (string) - Description of the report that appears in the Alert Logic console (example: This report provides a comparison of new, resolved and unresolved vulnerability instances in your environment from the previous day.)
  - report_id (string) - Report execution identifier (example: 20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010). Alert Logic recommends you use id instead.
  - report_type (string) - Name of scheduled report as displayed in the Alert Logic console (example: Daily Vulnerability Variance)
  - result_count (number) - Number of rows in the generated report, where a zero means the report is empty (example: 1471). Alert Logic recommends that you use artifact_data.result_count instead.
  - schedule_id (string) - Schedule identifier (example: 48DF99CF-C94F-1005-8001-0242AC110010). Alert Logic recommends that you use schedule_id instead.
  - scheduled_report_name (string) - Name of the report schedule (example: Daily Variance Report). Alert Logic recommends that you use name instead.
- result_count (number) - Number of rows in the generated report, where a zero means the report is empty (example: 1471)
- result_id (string) - Generated report identifier (example: 72DB7F39-E717-1005-8001-0242AC110016)
created (object)
- at (number) - Epoch time of schedule creation (example: 1661462760)
- by (string) - User ID that created the schedule (example: A3CBF982-2FED-4E4B-9168-9E28F22FEEE3)
delete_empty_result (Boolean) - Whether the notification and report are deleted automatically if results are empty (example: false)
id (string) - Scheduled report execution ID (example: 20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010)
modified (object)
- at (number) - Epoch time of the schedule change (example: 1661462780)
- by (string) - User ID that changed the schedule (example: A3CBF982-2FED-4E4B-9168-9E28F22FEEE3)
name (string) - Name of the report schedule (example: Daily Variance Report)
notify_behavior (string) - Choice of when to send notifications (example: ifnotempty)
Valid values: always, never, ifnotempty - send a notification only if execution returns results that are not empty; see result_count
publish_result (object or string) - Result of sending the notification. A value of null means that the user does not request sending a notification; see notify_behavior.
- status (string) - Notification status (example: ok)
  Valid values: ok or an error
- timestamp (number) - Epoch time stamp indicating when the notification was sent (example: 1661462760)
published (Boolean) - Whether a notification was sent (example: false)

Valid values: true, false
run_once (Boolean) - Whether the report was scheduled to be run only once. Schedule frequency is ignored if "true" is the value (example: false)

Valid values: true, false
schedule (object) – Schedule frequency and time when report is scheduled to run (example: daily)
Valid values: daily, weekly, monthly
- daily (object) – Schedule frequency value set by the user. Values are mutually exclusive.
  - hour (number) - GMT hour when the report is scheduled to run in 24-hour clock format (example: 21)
  - minute (number) - Minute portion of time when report is scheduled to run (example: 26)
- weekly (object) – Schedule frequency value set by the user. Values are mutually exclusive.
  - day (string) - Day of the week when the report is scheduled to run (example: tuesday)
    Valid values: sunday, monday, tuesday, wednesday, thursday, friday
  - hour (number) - GMT hour when the report is scheduled to run in 24-hour clock format (example: 21)
  - minute (number) - Minute portion of time when report is scheduled to run (example: 26)
- monthly (object) – Schedule frequency value set by the user. Values are mutually exclusive.
  - day (number) - Day of the month (1-31) when the report is scheduled to run (example: 15)
  - hour (number) - GMT hour when the report is scheduled to run in 24-hour clock format (example: 21)
  - minute (number) - Minute portion of time when report is scheduled to run (example: 30)
schedule_id (string) – Schedule identifier (example: 48DF99CF-C94F-1005-8001-0242AC110010)
scheduled_time (number) – Epoch time when the report is or was scheduled to run (example: 1661462760)
status (string) – Current state of the scheduled report execution (example: completed)
Valid values: scheduled, running, completed, failed, canceled, deleted
type (string) – Schedule type (example: tableau)
Value for a report schedule: tableau
extra (object) - Additional information about the scheduled report notification
- artifact_create_date (string) - Date and time the scheduled report was generated in the format YYYY-MM-DD HH:MM GMT (example: 2022-08-25 21:26 GMT). Alert Logic recommends you use artifact_data.metadata.artifact_create_date instead.
- cadence (string) - Schedule frequency and time when report is scheduled to run in human-readable format (example: Daily, 21:26 GMT). Alert Logic recommends you use artifact_data.metadata.cadence instead.
- cid (string) - Customer account identifier (example: 12345678). Alert Logic recommends you use account_id instead.
- customer_name (string) - Customer name of the Alert Logic account where the report was scheduled (example: XYZ Corporation). Alert Logic recommends you use artifact_data.metadata.customer_name instead.
- download_url (string) - URL for downloading the scheduled report from the Alert Logic console (example: https://console.intelligence.alertlogic.com/#/artifacts/12345678?aaid=12345678&reportId=20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010)
- report_description (string) - Description of the report that appears in the Alert Logic console (example: This report provides a comparison of new, resolved and unresolved vulnerability instances in your environment from the previous day.). Alert Logic recommends you use artifact_data.metadata.report_description instead.
- report_id (string) - Report execution identifier (example: 20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010). Alert Logic recommends you use id instead.
- report_type (string) - Name of scheduled report as displayed in the Alert Logic console (example: Daily Vulnerability Variance). Alert Logic recommends you use artifact_data.metadata.report_type instead.
- result_count (number) - Number of rows in the generated report, where a zero means the report is empty (example: 1471). Alert Logic recommends that you use artifact_data.result_count instead.
- schedule_id (string) - Schedule identifier (example: 48DF99CF-C94F-1005-8001-0242AC110010). Alert Logic recommends that you use schedule_id instead.
- scheduled_report_name (string) - Name of the report schedule (example: Daily Variance Report). Alert Logic recommends that you use name instead.
- ui_url (string) - URL that links to the scheduled report in the Alert Logic console (example: https://console.intelligence.alertlogic.com/#/dashboard/12345678/Vulnerability/VulnerabilityVariance/DailyVulnerabilityVariance?aaid=12345678)

Sample JSON

Alert Logic uses this JSON object to test templated connections with a Scheduled Report Notification payload type.

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
{
  "account_id": "12345678",
  "artifact_data": {
    "attachments": [
      {
        "name": "Daily Variance Report 2022-08-25 21:26 GMT.gz",
        "url": "https://api.cloudinsight.alertlogic.com/cargo/v2/12345678/execution_record/20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010/result"
      }
    ],
    "create_time": 1661462780,
    "metadata": {
      "artifact_create_date": "2022-08-25 21:26 GMT",
      "cadence": "Daily, 21:26 GMT",
      "cid": "12345678",
      "customer_name": "XYZ Corporation",
      "report_description": "This report provides a comparison of new, resolved and unresolved vulnerability instances in your environment from the previous day.",
      "report_id": "20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010",
      "report_type": "Daily Vulnerability Variance",
      "result_count": 1471,
      "schedule_id": "48DF99CF-C94F-1005-8001-0242AC110010",
      "scheduled_report_name": "Daily Variance Report"
    },
    "result_count": 1471,
    "result_id": "72DB7F39-E717-1005-8001-0242AC110016"
  },
  "created": {
    "at": 1661462760,
    "by": "A3CBF982-2FED-4E4B-9168-9E28F22FEEE3"
  },
  "delete_empty_result": false,
  "id": "20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010",
  "modified": {
    "at": 1661462780,
    "by": "A3CBF982-2FED-4E4B-9168-9E28F22FEEE3"
  },
  "name": "Daily Variance Report",
  "notify_behavior": "ifnotempty",
  "publish_result": {
    "status": "ok",
    "timestamp": 1661462760
  },
  "published": false,
  "run_once": false,
  "schedule": {
    "daily": {
      "hour": 21,
      "minute": 26
    }
  },
  "schedule_id": "48DF99CF-C94F-1005-8001-0242AC110010",
  "scheduled_time": 1661462760,
  "status": "completed",
  "type": "tableau",
  "extra": {
    "artifact_create_date": "2022-08-25 21:26 GMT",
    "cadence": "Daily, 21:26 GMT",
    "cid": "12345678",
    "customer_name": "XYZ Corporation",
    "download_url": "https://console.intelligence.alertlogic.com/#/artifacts/12345678?aaid=12345678&reportId=20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010",
    "report_description": "This report provides a comparison of new, resolved and unresolved vulnerability instances in your environment from the previous day.",
    "report_id": "20220825-212600-48DF99CF-C94F-1005-8001-0242AC110010",
    "result_count": "1471",
    "schedule_id ": "48DF99CF-C94F-1005-8001-0242AC110010",
    "scheduled_report_name": "Daily Variance Report",
    "ui_url": "https://console.intelligence.alertlogic.com/#/dashboard/12345678/Vulnerability/VulnerabilityVariance/DailyVulnerabilityVariance?aaid=12345678"
  }
}