Reports and exports

Rivanorth Oko gives you two ways to get your alerts out of the app: a report you can share, and a CSV export for analysts who need the full data.

Reports

A report summarises your alerts for a period. It contains everything a reader needs to understand what was found and what to do, but never the exposed data itself. A report names the affected account, the breach it appeared in, the description, the impact and the remediation. It never contains a password, a password hash or the exposed data, so you can send it within your organisation by email without risk of leaking the finding again.

Reports only include confirmed alerts. Alerts that are still Under review are left out.

Generating a report

1. Open Reports.
2. Under Report Content, choose Comprehensive (alerts and third parties), Alerts Only or Third Parties Only.
3. Under Report Period, choose Last 7 days, Last 30 days, Last quarter or Year to date, or pick your own start and end dates in the calendar. The dates the report will cover are shown underneath.
4. Under Output Format, choose PDF or HTML.
5. Choose Generate Report. Oko builds the report and the download starts as soon as it is ready.

The third-party report lists each third party with its Business Criticality, Data Sensitivity, Threat Score and Overall Risk. See third parties.

CSV export

The CSV export contains the exposed data. It is for analysts who need to process the findings themselves, for example to reset a list of accounts.

1. Open Alerts.
2. Set the filters so the page shows the alerts you need.
3. Choose Export to CSV.

The file contains the alerts currently shown on the page. Set the page size at the bottom of the list to 25, 50 or 100 to control how many alerts you get in one file. Each row carries the alert’s status, risk level, type, date, breach, email, username, exposed data, description, impact and remediation.

Caution

The CSV holds the exposed data in readable form. Only download it when you need it, only let trained staff handle it, and delete it when you are done.

Other ways to get alerts

• To send each confirmed alert to your SIEM, SOAR or ticketing system as it happens, use the webhook.
• An MCP server, so your AI assistant can read and work alerts for you, is on the roadmap.