Reporting and Platform Operations
Domain 8 tests reporting and day-to-day platform operations. Expect questions on scheduled reports, dashboards, syslog and API export, health monitoring, capacity, and using metrics to tune policy.
Core rules
- Separate operational reports such as quarantine, queue, and delivery from executive reports such as threat volume and top targeted users.
- Track false positives and false negatives; raw block counts can mislead.
- Export via syslog, CEF, or API to a SIEM; preserve retention and time synchronization.
- Monitor connector health, queue depth, disk, and update status.
- Baseline normal volume; investigate sudden changes in quarantine or rejection rates.
Worked example
Quarantine volume jumps 30% after a new rule. Compare by rule hit and sender domain: the rule is catching a legitimate newsletter with a "verify" link. Narrow the condition, add an allow exception for the newsletter domain, and monitor for a week. Do not disable the rule globally, which would reopen the gap it was meant to close.
Traps that cost marks
Celebrating high block counts without false-positive review; ignoring time zones in reports; changing policy without a baseline; missing syslog gaps; and monitoring only inbound traffic while outbound issues grow.