{{indexmenu_n>13}}
====== Case 13. Setting Up Email Report Distribution ======

Report distribution is configured through the “Mailing” menu section.

===== Creating a Recipient Group =====
Before creating a distribution, it is recommended to set up a recipient group: go to Mailing → Add New Recipient Group, assign a name to the group, and add all necessary email addresses.
{{ :csg:use_case:recipients.png?nolink&1200 |}}
<note important>When modifying a recipient list that is already being used in distributions, **save these distributions again** (by clicking Save Changes); otherwise, the changes will not apply.</note>

===== Creating a Template =====
Custom templates can be created for different types of distributions.
  - Go to Mailing → Add new mailing template.
  - Assign a template name, which will appear in the list when [[csg:use_case:mailing#step_2_fill_in_the_email_template|creating a distribution]] (Step 2).
  - Fill in the template content. You can insert a System Template by clicking “System Template” and then modify its content and formatting as needed.\\ {{ :csg:use_case:add_template.png?direct&1200 |}}
    - First, select the data format for the distribution:
      * If the distribution includes multiple reports, choose whether they should arrive as separate files or combined into one //(to combine reports into one file, use parameters with “merged” in the name)//;
      * Choose the format: CSV or Excel //(for CSV — use parameters with “csv” in the name, for Excel — use parameters with “xlsx”)//;
      * Specify whether the report will be an attachment or a link in the email text //(attachment — “as_file” in the parameter name)//;
      * If it will be an attachment, specify if the file will be archived or unarchived //(archive — “zip” in the parameter name)//.\\ **If you need to attach a file rather than a link, we recommend selecting “Archive with file” as the report size may exceed the email attachment limit.**
    - Update the file in the email text by inserting a new identifier:
      * Click the Template Parameters button {{:csg:use_case:template_parameters.png?nolink&20|}}, choose the identifier(s) needed, then use ''Ctrl+C'' to copy and ''Ctrl+V'' to paste it into the email template.

<note important>**Protocol column can be removed from PDF reports.**\\
The setting is available in Operator GUI in GUI Configuration → Trigger Settings → “Hide display of protocol number…".\\
If this setting is enabled, exported reports will not include protocol numbers.

{{ :csg:use_case:pdf_report_protocol_number.png?nolink&900 |}}
</note>

If necessary, you can edit the email text.
**Remember to save your changes!**
{{ :csg:use_case:id_selection.png?direct&1200 |}}

===== Creating a Distribution =====
==== Step 1. Fill in Basic Information ====
  - Go to Distribution → Add Distribution.
  - Set the Name. The name will appear in the Distribution List section and in the attached file name.
  - Set the Email Subject.
{{ :csg:use_case:basic.png?nolink&1200 |}}

==== Step 2. Fill in the Email Template ====
  - Click the Select Templates button.\\ {{ :csg:use_case:select_template.png?direct&1200 |}}
  - In the opened window, select the appropriate template and click Insert. //The template can be edited immediately if needed.//\\ {{ :csg:use_case:customer_template.png?direct&900 |}}

You may also fill out the content directly in the editing window, following the instructions from the [[csg:use_case:mailing#creating_a_template|Creating a Template]] section from Step 3 onward.

==== Step 3. Set the Schedule ====
Configure the schedule: select days of the week, the report generation time, and email sending time. There are two options:
  - Set only the Distribution Time.\\ For example, if Distribution Time is set to 9:00 and Day of the Week is Monday, the report will cover the period from 9:00 Sunday to 9:00 Monday, and will be sent at 9:00 on Monday.
  - Set both Distribution Time and Report Time by enabling the “Configure Report Time” toggle.\\ For example, if Distribution Time is 15:00, Report Time is 11:00, and Day of the Week is Wednesday, the report will cover the period from 11:00 Tuesday to 11:00 Wednesday, and will be sent at 15:00 Wednesday.

{{ :csg:use_case:shedule.png?nolink&1200 |}}

==== Step 4. Configure Queries ====
=== Selecting a Report ===
{{ :csg:use_case:add_a_report.png?direct&1200 |}}

  - Click Add under “Queries”. A default entry “Top Subscribers with High RTT” will appear.
  - To change the report, click the Report cell in the added entry. For example, select a report containing IP addresses of hosts. Here, the Raw Complete NetFlow → Tables → Attack Detection → Top Host IP Addresses → By Traffic report would be appropriate.
  - Rename the report. This name will appear in the file attached to the distribution.
  - Configure the report:
    - For a table report, specify columns visibility, rows limits, display filter, and page orientation;\\ {{:csg:use_case:table_settings.png?direct&400|}}
    - For a chart report, specify chart type, chart step, items limit, display filter, and page orientation.\\ {{:csg:use_case:graph_settings.png?direct&400|}}

=== Applying Filters for Specific Results ===
Filters can narrow down reports based on traffic direction or AS, for instance.
  - Click the filter icon.\\ {{ :csg:use_case:filter1.png?nolink&1200 |}}
  - Enable the desired filter and set its value in the opened window.\\ {{ :csg:use_case:filter2.png?nolink&550 |}} 
  - If the filter needed is not in the list, add it by clicking the **+** icon (a new entry will appear), then select the filter by clicking “Filter” in the new entry.\\ {{ :csg:use_case:filter3.png?nolink&550 |}}
=== Select the Report Period ===
Choose the time range for the report data. For instance, for daily data, select “Period from” — “now - 24 hours”, “Period to” — “now”.
{{ :csg:use_case:period1.png?nolink&1200 |}}
=== Set the Maximum Execution Time for the Report ===
It is recommended to set the Maximum Report Execution Time to 30 minutes.
{{ :csg:use_case:max_time1.png?nolink&1200 |}}
=== Verify ===
To check if the query is correctly configured, preview the report by clicking the preview icon {{:csg:use_case:viewing.png?nolink&20|}} to the right of it.\\
//Reports can include up to 1 million records.//
{{ :csg:use_case:check1.png?nolink&1200 |}}

==== Step 5. Add a Recipient Group ====
Select a group and click Add.
{{ :csg:use_case:add_recipients.png?nolink&1200 |}}

==== Step 6. Save ====
Save the distribution once configured.

==== Step 7. Test the Distribution ====
After creating a distribution, it is recommended to test it. Forced Distribution will initiate email sending outside of its schedule.
  - Go to Mailing → Mailing List.
  - Click Force Run Mailing.
  - Choose the report time: 
    - Selecting "now" will generate a report for the past 24 hours and send the distribution immediately.
    - Selecting a specific time (e.g., 9:00) will generate a report for the period from 9:00 yesterday to 9:00 today and send it immediately, reflecting the desired time period data in the report.
{{:csg:use_case:forced_mailing.png?nolink&400|}}

===== Viewing Distribution List =====
In the Mailing → Mailing List section, you can:
  * View basic information about created distributions: name, email subject, creation date;
  * Enable and disable distributions;
  * Track distribution status: Waiting, Caching, Checking, Notification.
  * Search, refresh the list of distributions.
  * Edit a distribution by clicking its name or the edit icon {{:csg:use_case:edit.png?nolink&20|}} to the right.
  * View distribution logs by clicking the log icon {{:csg:use_case:log.png?nolink&20|}}, showing the time and recipients of the distribution and its status.
  * Manually start a distribution by clicking the lightning icon {{:csg:use_case:forced_start.png?nolink&18|}}.
  * Delete a distribution by clicking the trash icon {{:csg:use_case:delete.png?nolink&18|}}.
  * Export the distribution list in Excel, CSV, PDF, PNG formats.