Template catalogue

Templates are the prepared questions reporting is built from. They live in the product, ship with the release, and cannot be created or edited — you build datasets over them.

43 templates are included: 16 presets (we lay them out; they export to PDF) and 27 tables (you choose the presentation; they export to PDF, CSV and XLSX). See Overview for what that distinction means.

There is no Templates item in the sidebar, and that is deliberate — a template is not something you administer. The catalogue is the first step of New dataset, under Logging & Reports → Reporting → Datasets: a searchable gallery grouped by the five areas below, in the order System · AAA · NAC · Configuration Tracker · Alerts, with presets ahead of tables inside each. Search matches a template’s title and its description.

Each card carries a Preset or Table badge, a Use this template button, and a Preview that opens the template’s passport: every column with its role (dimension or measure) and format, the filters it takes, its views if it is a preset or the charts it can be drawn as if it is a table, and — for an account holding reports.run — a live sample over the last seven days.

The area is declared in code, not guessed from the template’s name. Authentication failures covers all three sign-in surfaces and so sits under System, while TACACS+RADIUS authentication is a raw AAA log and sits under AAA. The catalogue below is grouped exactly the way the product groups it.

• Views — the alternative cuts a preset offers over the same data. Tables have none; their presentation is yours. Nine of the sixteen presets ship two views and the other seven ship one, so there are 25 authored layouts in all.
• Period — yes means the template takes a time window. point-in-time means it is a snapshot of how things are right now, and offers no period at all.

For a table, that Period column doubles as the chart column. The nine tables that take a period are the log-like ones, and each declares which of its columns may be grouped or bucketed by time — so those can be drawn as a bar, a pie or a line as well as a table. The eighteen point-in-time tables are inventories with nothing to aggregate over a window: they declare no grouping at all, and the passport says so outright — “This template is shown only as a table.”

Wide tables also arrive pre-trimmed. A template may mark a column hidden by default, which is what keeps a sixteen-column table like NAC session history on the page instead of scrolling off it — nine of its columns start hidden, seven show. Hidden is not restricted — the column is fully declared and stays a valid choice to show, and a dataset can simply switch it on. It is a curation knob about what fits, not about what you are allowed to see.

Device administration over TACACS+ and RADIUS.

Template	Type	Views	Period
AAA activity & trend	Preset	full · hourly	yes
AAA overview	Preset	full · totals	yes
Policy & command insights	Preset	policy · commands	yes
RADIUS device usage	Preset	usage	yes
TACACS+ device usage	Preset	usage	yes
AAA policy	Table	—	point-in-time
RADIUS accounting	Table	—	yes
RADIUS authentication	Table	—	yes
RADIUS profiles	Table	—	point-in-time
TACACS accounting	Table	—	yes
TACACS authentication	Table	—	yes
TACACS authorization	Table	—	yes
TACACS+ profiles	Table	—	point-in-time
TACACS+RADIUS authentication	Table	—	yes

The two device usage presets are worth calling out: they rank your busiest devices and your quietest, including devices that made zero requests in the window. A device that has stopped authenticating produces no log rows at all, so it can only be spotted from the inventory side — which is what these two do.

TACACS authorization makes the authorized command visible and groupable, so “which commands are people actually running” is a chart rather than a log trawl.

802.1X port access, endpoints, guests and certificates.

Template	Type	Views	Period
NAC access overview	Preset	overview · rejects	yes
NAC certificate posture	Preset	overview	point-in-time
NAC sessions	Preset	live · history	yes
Endpoint groups	Table	—	point-in-time
Endpoints	Table	—	point-in-time
Guest sessions	Table	—	yes
NAC active sessions	Table	—	point-in-time
NAC authorization profiles	Table	—	point-in-time
NAC policy	Table	—	point-in-time
NAC session history	Table	—	yes

NAC access overview carries a day-by-hour heatmap of authentications, which answers “when” in a way a daily total cannot — a burst of rejects at 03:00 looks nothing like the same count spread across a working day. Its rejects view is the forensic cut: reasons, the NAS devices doing the rejecting, and the MAC addresses being rejected.

NAC certificate posture buckets the internal CA’s certificates by time to expiry — expired, within 7 days, 30, 90, and valid — so an expiry wave is visible before it becomes an outage. Only metadata is ever projected; private keys and signing requests are never readable through reporting.

Guest sessions is deliberately careful with personal data: aggregation is offered only over non-personal dimensions, and the sponsor’s email and company are hidden by default.

The configuration collection engine and its history.

Template	Type	Views	Period
NCM collection health	Preset	full · trend	yes
NCM change activity	Preset	overview	yes
NCM JIT activity	Preset	overview	yes
Collection sources	Table	—	point-in-time
Tracked configs	Table	—	point-in-time

NCM change activity answers what actually moved in a period: how many snapshot versions were cut, across how many configs, the top churn, the text-versus-binary split and which version labels were applied.

NCM JIT activity covers just-in-time credential behaviour — passwords minted and rotated, leases live now, and how many mints were exposed to a standalone collector. It never projects credential plaintext.

The platform itself: inventory, health, accounts and the audit trail.

Template	Type	Views	Period
Authentication failures	Preset	overview	yes
Inactive users	Preset	list	point-in-time
Platform inventory	Preset	aaa · nac	point-in-time
System Health & Fleet	Preset	live · activity	yes
Activity log	Table	—	yes
Device groups	Table	—	point-in-time
Devices	Table	—	point-in-time
Log exclusions	Table	—	point-in-time
Network objects	Table	—	point-in-time
RBAC roles	Table	—	point-in-time
Syslog destinations	Table	—	point-in-time
User groups	Table	—	point-in-time
Users	Table	—	point-in-time

Authentication failures is the cross-surface one, and the most useful single preset for a security review. It puts failures from all three sign-in surfaces side by side — the admin UI, device administration (AAA), and port access (NAC) — as rates rather than raw counts. That is deliberate: NAC volume dwarfs UI volume by orders of magnitude, so raw counts on one chart would hide the very thing you are looking for. Each surface keeps its own axis.

Inactive users lists the longest-dormant accounts, with accounts that have never signed in ranked first — the correct answer for an access review, and one a plain sort would bury at the bottom.

Activity log is the reporting face of the audit trail, and it is deliberately wider than the Activity Log screen. It projects the event type raw, with no enumeration filtering it, so it reaches all 312 audit event types the platform can record — while the Activity Log screen’s own event-type filter offers a curated 88. That asymmetry is useful: if an event has no entry in that filter, you can still report on it. Group the Activity log table by Action and it appears under its own name.

Its columns are the who (Actor), the what (Action), the Entity type, the affected Target and the source IP address; Target is the one column hidden by default, because it can be long. The free-text details blob and the user agent are never projected at all.

Template	Type	Views	Period
Alerts overview	Preset	overview · compact	yes

Open, critical and firing counts, the severity mix, the resolved-versus-firing lifecycle split, the top sources and conditions, and a feed of the most recent openings.

• Datasets — building on a template
• Overview — presets, tables and the three layers