Do not send Blank Reports
I am using RSA SA 10.6.5.2
There are many scheduled report which result in empty output/result.
Output action is set as SMTP email.
I would like to see email of the report(s) only if the report is NOT empty.
Is there any option for "Not Sending blank reports" in Report Scheduling option?
you can enable either partial reports or completed reports for output actions under Reporting eingne->Explore->com.rsa.soc.re->OutputActionConfig. But not empty reports.
Disabling smtp action for empty reports works for you.
This is a frequent request I've heard from many different organizations, and seen multiple RFEs for this dating back quite a ways.
Best advice I can offer is to submit your own RFE (open a support case and they'll help document and submit it), as well as cast your vote on the existing Idea for this exact topic here: https://community.rsa.com/ideas/1498
Hi one problem with the "dont send me a report if it is blank" option, is that you might not get a report for two reasons:
1) The report was genuinely blank
2) There was an issue creating the report or emailing it to you.
At least if you do receive a blank report, you know that your report ran successfully and is genuinely blank.
All feature requests of this type should only go to the RSA Ideas area at this time. https://community.rsa.com/community/products/netwitness/ideas
Please note that no new features are being added to 10.6.x as it will be going end of life in October of 2019. So any new features requested will only be for 11.x.