“Can We Get a Report?” For Our Clients, the Answer Is Now Yes

Most of the people who depend on a SOC will never log into it. Here's how we're getting the right report in front of them.

There's a question I hear in almost every client conversation, usually right after we've walked through their dashboards: "This is great, but can we get a report?"

It took me a while to appreciate how much that question matters.

Reports are how security work gets seen

Most of the people who depend on security monitoring will never open a SIEM. The CEO wants to know whether things are under control. An MSSP's end clients want proof they're getting what they pay for. Auditors and insurers want dated evidence that monitoring actually happened. The IT director wants a weekly view without having to log in and click around.

For a lot of those people, the report is the only part of the SOC they ever see. When it shows up regularly and it's clear, it builds trust in the work your team is doing. When it doesn't show up, the work is mostly invisible to them, however good it is.

The gap

Open-source SIEM is great at the hard part. You get the detections, the data and the dashboards without a per-GB license bill. What it hasn't given you is a way to turn all of that into a report that goes out on its own. Grafana open source, which is where most of these dashboards live, doesn't schedule reports; that's a Grafana Enterprise feature.

So teams fill the gap by hand. Someone exports panels, grabs screenshots, pastes them into a document and sends it. It takes hours, it looks a little different every month, and when things get busy it's the first task that slips. For an MSSP it gets worse with every new client, because every client needs their own.

How we're closing it

That's why I'm really excited to introduce SOCFortress Reports, powered by Skedler. We've partnered with Skedler, built by the team at Guidanz, to bring automated reporting to the stacks we build and run.

The short version: the dashboards we already build for you can now go out as branded PDF or Excel reports, automatically, on whatever schedule you need. Nothing in your SIEM changes, it works with Grafana open source, and our team does the setup.

Shankar Radhakrishnan, CEO of Skedler, put it well:

"SOCFortress has made enterprise-grade security accessible to everyone through open source, and reporting has been the missing piece in open-source SIEM. Skedler and SOCFortress are partnering to close that gap so MSSPs can show their value to every client on a regular schedule, not just when an incident happens."

What it looks like for you

• If you're an MSSP, every client gets a branded monthly security report built from their own data, without anyone on your team building it.
• If you're a security or IT lead, leadership gets a short weekly summary in their inbox, and you stop being asked "what did the SOC do this month?"
• If you're working toward SOC 2, HIPAA or PCI, you get dated, recurring evidence collected automatically, ready before the auditor asks for it.

Getting started

For our existing clients, our team will handle the setup as part of your SOCFortress Reports license. You can start on a 15-day trial, so you'll see reports built from your own data before you decide anything.

What's next

Next week I'll publish a video walking through how we go from a dashboard to a scheduled report end to end. After that, we'll dig into MSSP client reporting and compliance reporting in more detail.

A big thank you to Shankar Radhakrishnan and Utkarsh Pandey at Guidanz for moving so quickly to get this partnership off the ground.

If reporting is the thing your team keeps putting off, book an intro call or take a look at the SOCFortress Reports page.