Issue:
When user has set the report data source to be "Security Events" for the Elements Endpoint Protection portal's "Reports > Email notification and report" feature, no email is sent at all when user clicks the Send test report button.
Resolution:
The reason why Send test report doesn't send an email when Security Events is used as the data source is because of the "Send only when report has content" setting, which is configured when creating the report. This setting can be a bit misleading, because it works more like "Send only when report has new content".
The report is sent only when an alert appears on the Elements portal's Security Events page that hasn't already been emailed before and is less than 24 hours old. Whenever an alert has been included in a sent email, it will be marked as sent. The report automatically uses the "Frequency = Continuous" setting, which means that precisely every ten minutes (e.g. 13:40 and 13:50, etc.) an email is automatically sent if Security Events contains unsent information.
This means that when you press the Send test report button, it is very likely that the Security Events list does not contain any new alerts and therefore no test email will be sent either. For the Send test report to work, the alert should have to arrive to the Security Events page for example at 10:51 and the Send test report button would be needed to be clicked before 11:00, when the report is automatically sent as per the continuous schedule.
As a workaround, you can temporarily disable the "Send only when report has content" setting in the report and then click on the Send test report button. This will send a report that still includes the link that will forward you to the Elements portal's Security Events page which the correct view automatically open. Remember to re-enable the "Send only when report has content" after you are done testing.
Article no: 000045544