Reporting Hub Overview

Reporting hub overview

The reporting hub in Petra is where you go to see security-related events and insights that aren't necessarily full incidents—things like blocked or failed attacks, unusual activity that might need a second look, and scheduled or on-demand reports. This article gives you an overview of what's in the reporting hub and how to use it.

Where to find the reporting hub

You can get to the reporting hub from a tenant's page or from a global reporting area, depending on how your navigation is set up. Either way, the hub is organized into tabs or sections so you can switch between different kinds of data: failed attacks, uncommon activity (interesting events), spotlighted investigations, Microsoft risk detections, and automated security reports. Each tab focuses on a specific type of finding or report so you can quickly find what you need.

What each area is for

Failed attacks—Shows attacks that were blocked or that didn't succeed (e.g., failed sign-in attempts, blocked phishing). Useful for seeing what threats were stopped and for understanding attack trends.

Uncommon activity (interesting events)—Surfaces behavior that stands out as unusual—for example, a user doing something they don't usually do. These may or may not become full incidents; they're worth reviewing to see if anything needs escalation.

Spotlighted investigations—Investigations or notes that your team has marked as "benign" or as worth keeping for reference. Helps you separate "we looked and it was fine" from open incidents.

Microsoft risk detections—Risk signals from Microsoft (e.g., Entra ID / Identity Protection). Petra can show these alongside its own findings so you have one place to see both.

Automated security reports—Scheduled reports that are generated and sent (e.g., by email) on a regular basis. You can see when the last one ran and access or download recent reports.

Using the reporting hub in your workflow

Use the reporting hub to get a broader view of security in the tenant: not just open incidents, but also what was blocked, what was unusual, and what Microsoft is flagging. You can use filters and date ranges to focus on a specific period or type of event. Many of these views support drilling down—clicking an event to see details or to open a related incident. That makes the reporting hub a central place for both daily triage and periodic review of your security posture.