Protoxol
Request a demo
Platform Modules Plans Blog Request a demo
RPT · Module

Reporting & analytics

Executive and operational reports from the same data you investigate.

Compare with 5 alternatives ↓

Overview

What RPT does.

Reporting & Analytics generates executive and operational reports from the exact same query layer your analysts hunt with. No separate ETL, no chart-ware drift. Templates for SOC 2, ISO 27001, board-of-directors and internal SLAs come pre-built; analyst dashboards are customizable in SQL with full schema introspection.

Features

Inside RPT.

Same data, no drift

Reports query the same warehouse as hunts. Numbers always match.

Scheduled exports

PDF, CSV, JSON. Push to email, Slack, S3 or your BI tool.

Executive templates

Board-ready dashboards: incident trend, MTTR, coverage, top risks.

Analyst customization

SQL editor with schema autocomplete. Save, share, schedule.

Compliance packs

SOC 2, ISO 27001, HIPAA, PCI-DSS evidence templates out of the box.

Use cases

Where RPT earns its keep.

Board reporting

Monthly security posture dashboards generated from real telemetry.

Audit evidence

Pre-built compliance reports cut audit prep from weeks to days.

SOC operations metrics

MTTR, MTTD, false-positive rate, coverage by tactic — live.

Technical specs

RPT under the hood.

Output formats PDF, CSV, JSON, XLSX, Markdown
Templates 40+ compliance and operational
BI integration Tableau, Looker, Power BI, Metabase
Schedule granularity Hourly to quarterly

Figures from internal testing; test method and date to be published.

Compare alternatives

Protoxol Reporting & analytics compared with five alternatives

A security report is only as good as its figures: if they do not match what you investigated, nobody can defend it in front of a client or an auditor. This comparison covers the reporting function of SOC and SIEM platforms, not five stand-alone reporting tools. It sets Protoxol Reporting beside five relevant alternatives and looks at operational and executive reports, scheduling, exports, traceability, per-client filtering, permissions and incident metrics. Each cell separates what official pages verify from what remains unconfirmed.

What Protoxol offers

Comparison table

Each cell shows the status and the scope. Statuses are explained below the table.

Show alternative:

Scroll the table sideways to see every column.

Protoxol Reporting & analytics compared with five alternatives
CriterionProtoxol Reporting & analyticsMicrosoft SentinelSplunk Enterprise SecurityGoogle Security Operations (SIEM)Elastic SecurityIBM QRadar SIEM
Operational and executive reports AvailableExecutive templates (incident trend, MTTR, coverage, top risks) and analyst dashboards in the same module. Depends on setupWorkbooks from Content hub templates or your own; Microsoft advises one per persona. For executives outside Sentinel, Power BI is used. ↗ AvailableMore than 100 dashboards ship in ES, including Security posture, Executive summary and SOC operations. ↗ AvailableCurated dashboards included (copy them, you cannot edit them) plus your own personal or shared dashboards. ↗ AvailableDefault Elastic Security dashboards plus your own tagged dashboards; system-managed ones are duplicated to edit them. ↗ AvailableReports tab with default and custom templates, and Pulse with dashboard templates for offenses and network data. ↗
Customisation AvailableSQL editor with schema autocomplete for analyst dashboards; save, share and schedule them. AvailableEditable workbooks with KQL queries, parameters and text; cloneable, with tiles built in Log Analytics pinned to them. ↗ AvailableDashboards can be customised and shared; a report starts from a saved search or pivot, and a dashboard panel can become a report. ↗ AvailableNew, copied or imported dashboards; YARA-L queries per chart, 1,000 rows by default and up to 10,000 in custom dashboards. ↗ AvailablePanels with controls, ES|QL variables and drilldowns to another dashboard, a URL or Discover. ↗ AvailableReport wizard, including reports built on a saved search; Pulse builds items from AQL queries or offenses. ↗
Scheduling and export formats AvailableScheduled exports to PDF, CSV and JSON, pushed to email, Slack, S3 or your BI tool. The spec list also names XLSX and Markdown. Needs integrationWorkbook: auto-refresh and manual PDF, Azure portal only. To share outside, export the query to Power BI. ↗ AvailableScheduled PDF delivery by email for reports and dashboards at any regular interval. Other formats not verified. ↗ AvailableScheduled email delivery as CSV, PDF or PNG, with a time filter. By default only to your own user domain. ↗ Depends on licenceScheduled email as CSV, PDF and PNG. PDF and PNG are a subscription feature; the attachment limit is 10 MB. ↗ Depends on setupReports run on a schedule or on demand and go out by email. Output formats were not verified. ↗
Tracing a figure back to the data AvailableReports and hunts share one query layer, so a figure can be reproduced. Jumping from a figure to its events is not described. AvailableEach tile is a KQL query over workspace tables; edit mode shows it. SecurityIncident logs every incident change. ↗ AvailableA report is a saved search you can open and re-run, so the query behind a figure can be reviewed. ↗ AvailableThe curated catalogue shows each chart's query. PDF and PNG capture only what is visible; dashboard CSV is per chart. ↗ AvailableA drilldown opens Discover from a panel, and a saved Discover session can be exported to CSV. ↗ AvailableA report starts from a saved search and Pulse from AQL queries, so the query behind a figure can be reviewed. ↗
Per-client filtering (MSP use) AvailableEach client's monthly report is built from that client's data. Multi-tenant architecture is listed in the Enterprise plan. Depends on setupOne workspace per client with Azure Lighthouse. Cross-workspace workbooks use cross-workspace queries or a workspace selector. ↗ Not confirmedThe official documentation read does not explain how to serve separate per-client reports from one ES deployment. Depends on setupDashboards follow data RBAC by scope. Dashboards on SOAR cases and playbooks are visible only to global users. ↗ Depends on setupSpaces keep rules, alerts and cases private per space, but you must limit access to alert indices with roles. ↗ Depends on setupDomains and security profiles separate each client's data. How reports honour them was not verified. ↗
Permissions on dashboards and reports Not confirmedThe pages mention sharing dashboards. Roles and permissions per report or per client are not described. AvailableEach workbook is an Azure resource under RBAC; at least Workbook reader or contributor is required. ↗ AvailableYou share a report by changing its permissions from the report itself. ↗ AvailableSeparate IAM permissions to list, view, create, duplicate, edit and delete dashboards; scheduling needs the Administrator or Editor role. ↗ AvailableSharing or generating reports needs a role with access to the indices and apps; scheduling has its own privilege. ↗ AvailableAn admin sees all reports; other users see their own or shared ones. In Pulse you see only your own widgets and dashboards. ↗
Incident metrics (MTTD/MTTR) AvailableCites MTTR, MTTD, false-positive rate and coverage by tactic, live. It does not publish how each metric is defined. AvailableSecurityIncident table plus an operations-efficiency workbook: mean time to triage and to resolve, by severity and MITRE tactic. ↗ Not confirmedA SOC operations dashboard exists. What it measures and how MTTD or MTTR is defined is not in the pages read. Not confirmedData sources exist for cases, case history and playbooks. How MTTD or MTTR is defined is not in the pages read. Not confirmedNo MTTD or MTTR definition, or dashboard that computes them, was found in the pages read. Not confirmedNo MTTD or MTTR definition, or report that computes them, was found in the pages read.
Data sources covered Depends on setupReads data from the console's active modules. The platform states ingestion from Wazuh, Splunk, Elastic, Suricata, Microsoft 365 and Okta. Depends on setupReads what you connect to the workspace. Some templates need specific data types (Required data types field). ↗ AvailableES runs on the Splunk platform to capture, monitor and report on data from security devices, systems and applications. ↗ AvailableUDM events, detections, IoCs, entity graph, ingestion metrics, cases and playbooks, each with its own query window. ↗ AvailableDashboards read data held in Elasticsearch through data views; whatever is not ingested there cannot be reported. ↗ AvailablePulse shows offenses, network data, threats, user behaviour and cloud; the licence is measured in events and flows. ↗
Native or add-on AvailableA platform module on its own query layer. It exports to Tableau, Looker, Power BI and Metabase if you use them. AvailableWorkbooks ship with Sentinel. Power BI is a separate product that needs a Power BI account and permissions. ↗ AvailableDashboards and reports are part of ES and the Splunk platform; no separate BI tool is required. ↗ AvailableDashboards built into the SIEM on top of Looker; scheduled delivery uses the same base. ↗ AvailableDashboards, exports and scheduling are part of Kibana, with no separate BI product. ↗ AvailableReports are built into the console; Pulse is a QRadar app. ↗
Licensing implication Depends on licenceActivated separately. Basic reporting in Starter, advanced in Team, custom in Enterprise; priced per protected endpoint. Depends on licenceSentinel bills by ingested volume (pay-as-you-go or commitment tiers); retention beyond 90 days is charged separately. ↗ Depends on licencePricing models are ingest, workload or entity based; Splunk does not publish a rate card and quotes on request. ↗ Depends on licenceThree packages (Standard, Enterprise, Enterprise Plus) priced by ingestion volume. Reporting differences per package not verified. ↗ Depends on licencePDF and PNG need a subscription. Serverless Security charges per ingested GB and per retained GB per month. ↗ Depends on licenceBase licence with capacity in EPS and FPM, expandable in blocks of 100 EPS and 10,000 FPM. ↗

What each status means

Available
Native feature of the product or plan compared.
Needs integration
Works through a connector or a third-party product.
Depends on setup
Exists, but its scope depends on deployment or configuration.
Depends on licence
Only in a higher plan or as a paid add-on.
Needs another product
Covered by a different product from the same vendor.
In development
Announced or being built; not generally available.
Not confirmed
Not enough evidence. It does not mean “no”.

Five comparisons

One per product, naming the plan that was compared.

Microsoft Sentinel

Plan or edition: Reporting via Workbooks and Power BI in Microsoft Sentinel (SIEM on Azure); billed per GB ingested. The cells describe the SIEM's reporting function, not a separate reporting product.

Sentinel builds its reporting on workbooks: KQL queries over your workspace, Content hub templates and Azure RBAC permissions per workbook. When someone without Sentinel access needs a figure, you export the query to Power BI, a separate product with its own account. Protoxol ships executive templates and scheduled exports inside the module, but its pages describe no per-report roles and define neither MTTD nor MTTR; Sentinel does publish an incident table and a SOC-efficiency workbook. It fits if your data and analysts already live in Azure. Condition: PDF output is available only in the Azure portal, which Microsoft stops supporting for Sentinel after 31 March 2027.

Official source ↗

Splunk Enterprise Security

Plan or edition: Reporting via dashboards and scheduled reports of Splunk Enterprise Security 8.x on the Splunk platform (Enterprise or Cloud). The cells describe the SIEM's reporting function.

Splunk Enterprise Security ships more than a hundred dashboards, among them Security posture, Executive summary and SOC operations. Reports are saved searches you schedule and email as PDF, and a dashboard panel can become a report. That gives you the full query power of Splunk, in exchange for learning its language. Protoxol puts a SQL editor and executive templates inside one module, with less documented depth. Splunk fits if you already run a deployment and analysts who write SPL. Condition: pricing follows ingest, workload or entities, and the documentation read does not explain how to serve separate per-client reports from a single ES.

Official source ↗

Google Security Operations (SIEM)

Plan or edition: Reporting via Google SecOps SIEM dashboards (Looker-based) and scheduled delivery; Standard, Enterprise and Enterprise Plus packages, without specifying which. The cells describe the SIEM's reporting function.

Google SecOps cleanly separates two things: curated dashboards you cannot edit but can copy, and your own dashboards built with YARA-L queries. You then schedule email delivery as CSV, PDF or PNG. Data RBAC filters what each user sees, except dashboards on SOAR case and playbook data, which only global users can open. Protoxol describes a monthly report per client, but not its roles. Google fits if you already buy its SIEM and your team uses YARA-L. Condition: scheduled email goes by default only to your own user domain, and price follows the package's ingestion volume.

Official source ↗

Elastic Security

Plan or edition: Reporting via Kibana dashboards and Reporting in Elastic Security; PDF and PNG depending on subscription, in Cloud or self-managed. The cells describe the SIEM's reporting function.

Elastic reports from Kibana. There are default Elastic Security dashboards, your own with controls and drilldowns that open Discover, and exports to CSV, PDF or PNG. Spaces keep rules, alerts and cases apart per client, but you configure the index privileges yourself. Protoxol does not detail chart types or drilldown, though it gives ready executive templates. Elastic fits if you already run Elasticsearch and want control over every panel. Condition: PDF and PNG are a subscription feature, a scheduled attachment tops out at 10 MB, and on Serverless only CSV exports of Discover sessions can be scheduled.

Official source ↗

IBM QRadar SIEM

Plan or edition: Reporting via the Reports tab and the Pulse app of QRadar SIEM as on-premises software; the SaaS version was transferred to Palo Alto Networks in 2024. The cells describe the SIEM's reporting function.

In QRadar you build reports from the Reports tab, with default and custom templates, and make dashboards in the Pulse app from AQL queries or offenses. Reports run on a schedule or on demand and go out by email; administrators see everyone's. For several clients you use domains and security profiles. Protoxol is offered as SaaS or self-hosted, and its reporting is one more module of the console. QRadar fits if you already run the on-premises SIEM. Condition: IBM divested the SaaS version to Palo Alto Networks in 2024, and the on-premises licence is measured in EPS and FPM.

Official source ↗

When to choose Protoxol

  • You are an MSP and each client needs a monthly report built from its own data, without stitching it together from several tools.
  • You want the report and the analyst's search to come from the same query layer, so figures can be reproduced.
  • You need executive templates and scheduled exports to email, Slack, S3 or BI with no separate ETL.

When to consider something else

  • You already run Sentinel, Splunk, Google SecOps, Elastic or QRadar and your analysts know its query language: reporting there avoids duplicating data.
  • You require documented per-report roles and permissions, or an incident table with triage and resolution metrics: Sentinel publishes both.
  • You need scheduled delivery as CSV, PDF and PNG with documented limits and permissions: Google SecOps or Elastic describe them.
  • Your report depends on data already ingested into Elasticsearch or Splunk and you do not want to move it: report where it lives.

See the module in a demo

Questions about this comparison

01Does this compare stand-alone reporting tools?

No. It compares the reporting function inside SOC and SIEM platforms. Tableau or Power BI stay out as separate tools, although Protoxol and Sentinel can feed them.

02What is the difference between a dashboard and a report?

A dashboard is queried live to operate; a report is fixed to a period, scheduled and delivered to someone who does not log into the console. Each product splits them differently: compare how each one delivers the report.

03How are MTTD and MTTR defined?

MTTD is the average time to detect an incident; MTTR can mean respond, resolve or recover depending on the company. Always ask for each metric's start and end point before comparing figures.

04Can I hand a client a report without giving them console access?

In Protoxol, the MSP page says client-facing reporting can carry your branding and that the console is meant for your analysts. With Sentinel, Power BI serves people who lack Sentinel access.

05Does the report match the dashboard in Protoxol?

The module page states it: reports and hunts use the same query layer. Check it against your data in a demo before committing a report to a client or an auditor.

Sources and review date

Reviewed on October 2, 2026. Reviewed by The Protoxol team.

Protoxol capabilities are based on the current commercial documentation on this site and were not technically validated in this review; anything undocumented is shown as “Not confirmed”. Vendor data comes from each vendor's public documentation on the date shown and may have changed.

Selection

See RPT against your data.

Thirty minutes. Your environment. The modules that fit. No slideware.

Book a demo See pricing