# Reports

## Overview

Get the reports that match the filter and the data of the reports. 

## Configuration

### Parameters

* Domain (`Domain`)

### Secrets

* `cisco_auth` corresponds to the API Token used to authenticate the connection to Cisco Umbrella.

To add a Secret, open the **Secret** fields and click **New secret**:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the secret corresponding to the value.
* Click **Save**.

<figure><picture><source srcset="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FlUo7CuVpPgIVm5VNjLw6%2Fnenenew.png?alt=media&#x26;token=eb7a7231-0ac2-4099-93f9-18f9ead5add1" media="(prefers-color-scheme: dark)"><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FTSD53FxGQOjijA3W3DhE%2Fimage.png?alt=media&#x26;token=9941a3c0-100a-4759-b603-30079fbc90de" alt=""></picture><figcaption></figcaption></figure>

{% hint style="info" %}
Learn more about secrets in Onum in [this article](https://docs.onum.com/administration/global-settings/organization-settings/secrets-management).
{% endhint %}

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Sentinel One Web API **Reports** fields, or simply paste the desired YAML.

### Configure as YAML

```yaml
withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: EpochMillis
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: https://${parameters.domain}/auth/v2/token
      headers:
        - name: Content-Type
          value: application/x-www-form-urlencoded
        - name: Accept
          value: application/json
        - name: authorization
          value: ${secrets.cisco_auth}
      bodyType: urlEncoded
      bodyParams:
        - name: grant_type
          value: client_credentials
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: false
collectionPhase:
  paginationType: offsetLimit
  limit: 100
  isZeroIndex: false
  request:
    responseType: json
    method: GET
    url: https://${parameters.domain}/reports/v2/activity
    queryParams:
      - name: from
        value: ${temporalWindow.from}
      - name: to
        value: ${temporalWindow.to}
      - name: offset
        value: ${pagination.offset}
      - name: limit
        value: ${pagination.limit}
  output:
    select: ".data"
    map: "."
    outputMode: element
retry:
  statusCodes: [429, 500, 502, 503, 504]
  type: fixed 
  fixed:
    interval: 2s
```

### **Manually Configure**

**Temporal Window**

Toggle **ON** to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

* **Duration -** 5 minutes (`5m`) as default, adjust based on your needs.
* **Offset -** `5m`
* **Format** - `EpochMillis`

**Authentication Stage**

Toggle **ON** to configure the authentication phase. This is required to get the token to pull data using **OAuth**.

* **Type**<mark style="color:red;">**\***</mark>**&#x20;-** `token`
* **Request Method**<mark style="color:red;">**\***</mark>**&#x20;-** `POST`&#x20;
* **URL**<mark style="color:red;">**\***</mark>**&#x20;-** `https://${parameters.domain}/auth/v2/token`
* **Headers**&#x20;
  * **Name** - `Content-type`
  * **Value** - `application/x-www-form-urlencoded`
  * **Name** - `Accept`
  * **Value** - `application/json`
  * **Name** - `Authorization`
  * **Value** - `${secrets.cisco_auth}`
* **BodyType**<mark style="color:red;">**\***</mark> - `UrlEncoded`
  * **Body params**
    * **Name -** `grant_type`
    * **Value -** `client_credentials`
* **Token Path**<mark style="color:red;">**\***</mark> - `.access_token`
* **Auth Injection**
  * **In**<mark style="color:red;">**\***</mark> - `header`
  * **Name**<mark style="color:red;">**\***</mark> - `authorization`
  * **Prefix** - `Bearer`
  * **Suffix** - `''`

**Collection Phase**&#x20;

* **Pagination Type**<mark style="color:red;">**\***</mark>**&#x20;-** `offsetLimit`
* **Limit** - `100`
* **Zero Index -** `false`
* **Request**&#x20;
  * **Response Type -** `JSON`
  * **Method**<mark style="color:red;">**\***</mark>**&#x20;-** `GET`
  * **URL**<mark style="color:red;">**\***</mark>**&#x20;-** `https://${parameters.domain}/reports/v2/activity`
  * **Query Params**&#x20;
    * **Name** - `from`
    * **Value -** `${temporalWindow.from}`
    * **Name** - `to`
    * **Value -** `${temporalWindow.to}`
    * **Name** - `offset`
    * **Value -** `${pagination.offset}`
    * **Name** - `limit`
    * **Value -** `${pagination.limit}`
* **Output**&#x20;
  * **Select -** `.data`
  * **Map -** `.`
  * **Output Mode** - `element`
* **Retry**&#x20;
  * **Status codes -** `[429, 500, 502, 503, 504]`
  * **Type -** `fixed`
    * Interval-`2s` &#x20;

Click **Create labels** to move on to the next step and define the required [Labels](https://docs.onum.com/the-workspace/listeners/labels) if needed.