---
locale: "en"
updated_at: "2026-07-28T10:10:20.241Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/reference/reporting"
---

# Reporting

Report types, data sources, and export options

## How FileAudit generates reports

FileAudit builds reports from two distinct data sources. Knowing which source a report uses tells you what must be configured for that report to return data.

### Event scanning

Event-based reports read the Windows Security events produced by Object Access auditing. They reflect activity as it happened: who accessed what, when, and how.

Reports built on event scanning:

- Access reports and denied access reports
- Statistics
- Permission changes and ownership changes
- Alert reports

These reports return data only if Windows Object Access auditing is correctly configured on the monitored paths. See [Windows audit](/fileaudit/docs/reference/windows-audit) for how auditing is set up.

### Snapshot mechanism

Snapshot-based reports read data captured when a snapshot is generated. A snapshot records the state of your paths at a point in time, not a stream of events.

A snapshot captures:

- NTFS permissions
- Ownership
- File and folder attributes
- File and folder size information

Reports built on snapshots:

- File and folder properties
- Simple permissions
- Advanced permissions

These reports do not depend on Windows Security events. If no snapshot exists, they return nothing. See [Manage permissions and properties snapshots](/fileaudit/docs/guides/operations/manage-permissions-and-properties-snapshots) to generate them.

## Access reports

Access reports display file and folder access events, based on [access types](/fileaudit/docs/reference/access-types). Each report is a predefined view: same event data, different filter applied.

| Report | Shows |
| --- | --- |
| All access events | Every event, no predefined filter |
| Audited path | Events on one or more specific paths |
| Windows server | Events from Windows servers |
| Cloud Storage provider | Events from cloud storage (Cloud add-on required) |
| All file and folder changes | Delete, write, attribute, system, permission, and ownership events |
| File rename | Rename events |
| File move | Move events |
| File read | Read events |
| File write | Write events |
| File and folder deleted | Deletion events |
| File execute | Execution events |

#### Denied access reports

Denied access reports use the same event data, restricted to refused access attempts.

| Report | Shows |
| --- | --- |
| Denied access | Every denied access attempt |
| Denied file read | Denied read attempts |
| Denied file write | Denied write attempts |
| Denied file and folder delete | Denied deletion attempts |

![All reports](https://a.storyblok.com/f/122374/1298x826/d55ee56aca/all-reports.png)

 

> **💡 Tip**
>
> You can launch an access report on a specific file or folder from Windows Explorer: right-click the item and select FileAudit. The console opens on the Audited path report for that item.

## Permission reports

Permission reports cover both the current state of permissions and the changes made to them.

- **Simple permissions** and **Advanced permissions** display NTFS permissions for monitored paths, in basic or advanced mode. Both require a snapshot. In these reports, only the root of each configured path is shown in full: a child file or folder appears only when its permissions differ from its parent. If an item is absent from the report, its permissions are identical to its parent.
  ![](https://a.storyblok.com/f/122374/1298x830/7cb18fe059/simple-permissions.png)
- **Permission changes** lists every modification made to NTFS permissions: the user who made the change, the date and time, the path, and the impacted user or group (the Principal). Each row can be expanded to compare old and new permissions, in basic or advanced mode.
  ![Permission changes](https://a.storyblok.com/f/122374/1298x830/e3230fd300/permission-changes.png)
- **Ownership changes** lists recorded attempts to take ownership of a file or folder: who, when, and on which path.
  ![Ownership changes](https://a.storyblok.com/f/122374/1298x830/091f842217/ownership-changes.png)

## Summary reports

**Statistics** gives an aggregated overview of access activity over a selected period: activity trends, most active users, most accessed files, most active sources, and high-volume indicators useful for tuning your audit scope and exclusions. This report cannot be filtered, printed, or scheduled. 

![Statistics accessed files, users and sources](https://a.storyblok.com/f/122374/1298x830/1b161f3496/statistics.png)

**File and folder properties** displays metadata captured in a snapshot: creation, modification, and last access dates, total size, compressed size, root folder size, and attributes (Read-only, Hidden, Archive, Compressed, Encrypted). Requires a snapshot. 

![](https://a.storyblok.com/f/122374/899x609/5cecf46a8a/filters-file-folder-properties.png)

## Alert reports

The **Alert history** report displays the events that triggered your configured alert rules, covering both single alerts and mass alerts. 

To create and tune the rules behind these alerts, see the guide [Manage alerts](/fileaudit/docs/guides/operations/manage-alerts).

![Alert history](https://a.storyblok.com/f/122374/1298x777/ac3f550924/alert-history.png)

## Data selection

A report shows only the data you point it at. Before reading or exporting a report, you set its time range, its data source, and any filters that **narrow the results**. 

The controls available depend on the report type: 

- event-based reports use a time period,
- snapshot-based reports use a snapshot.

### Time period

Access reports and other event-based reports open on a **Period selector** at the top of the view. It sets the time range the report covers and is applied before the report is generated.

The selector offers predefined periods and a **Custom range** option. Custom range opens **From** and **To** fields, each able to anchor on a fixed date and time or on a relative bound such as **Event from** (the first recorded event) and **Last event** (the most recent).

![Reports period filters](https://a.storyblok.com/f/122374/612x556/8113daf438/report-filters-period.png)

### Snapshot selection

Snapshot-based reports (Simple permissions, Advanced permissions, File and folder properties) do not use a time period. They open on a **Snapshot** selector instead, because they read the state captured at a point in time rather than a stream of events.

Pick a snapshot from the list to display it. If none exists, the selector shows **No snapshot available** and the report returns nothing until one is generated. See [Manage permissions and properties snapshots](/fileaudit/docs/guides/operations/manage-permissions-and-properties-snapshots) Guide to create them.

### Filters

Most reports can be narrowed with filters. Click the **Filters** button to open the panel; once filters are set, the button shows how many are active (for example, *1 filter applied*). The panel groups conditions under **What**, **Who**, and **Source**, plus a **Path** scope and a **Server** selector.

The filters available vary by report type: access, permissions, and summary reports each expose a different subset. 

- For what each field means and the values it accepts, see [Filters](/fileaudit/docs/reference/filters) Reference.
- To target or exclude several users or groups in one field, see [Filters → Include or exclude users](/fileaudit/docs/reference/filters#include-or-exclude-users) Reference.

![Report filters](https://a.storyblok.com/f/122374/874x644/0925183294/filters-reports.png)

### Archived databases

The Filters panel also includes a **Database** selector. By default a report reads the production database, but the selector lists any archived databases that have been registered, letting you run the same report against archived data instead.

Archiving keeps the production database lean while preserving older events for retention or compliance. 

To create an archive and register it for querying, see [Archive database](/fileaudit/docs/guides/database/archive-database) Guide.

## Detailed views

Click a user or path in a report to open a granular view of that object, covering the last four weeks: 

- an access evolution chart grouped by day or week,
- a grid of all accesses,
- the total count of deletions and denied accesses,
- and the top 5 files accessed (for a user) or top 5 users (for a file or folder).

The grid keeps the same filter, print, and export options as the main views.

![](https://a.storyblok.com/f/122374/1284x680/8e43ae4c0c/user-detailed-views.png)

## Scheduled reports

A scheduled report runs automatically on a recurring basis and is emailed as a PDF to chosen recipients or saved to a file location. Any filters applied to the report are kept when it is scheduled.

You can schedule a report two ways:

- From the **Scheduled reports** tile on the FileAudit hub.
- From any built-in report: open the Options menu … and select **Schedule this report**. You are taken to the scheduling configuration with your current filters preserved.

Scheduled report delivery by email requires configured email settings. For the full setup procedure, see the guide [Manage schedule reports](/fileaudit/docs/guides/operations/schedule-reports).

![Scheduled report configuration](https://a.storyblok.com/f/122374/1036x654/ee8ae83dc9/scheduled-report-configuration.png)

## Export and print

From the report Options menu (the **…** button) or the print preview, select **Export data** to save the view as PDF, XLS, TXT, CSV, HTML, MHT, or RTF. Ctrl+click a format to open its detailed export options.

The **Raw Data** export produces a CSV of the unformatted data.

Select **Print** to open a preview showing the page count; you can also export directly from the preview.

## Favorite reports

In the **All Reports** view, select the star icon on a report tile to pin it to the dashboard. Favorites keep their saved configuration, and there is no limit on how many you can pin.

![Add favorite reports](https://a.storyblok.com/f/122374/917x497/d9068beddf/favorite-reports.png)