Perform the Report View assessment scan

Scan your instance for reports that users would be unable to view based on existing access control lists (ACLs).

Before you begin

Roles required: admin and security_admin.

About this task

The assessment scan returns a list of affected reports. A report is affected if a user has seen the report who would not be able to see it based on a report_view ACL or blocking READ ACL, in the case of reports based on tables without report_view ACLs.

The time the assessment scan takes can vary according to the number of records in the instance. Consider running the assessment over night. Also consider filtering the reports that the assessment applies to. For more information, see Filter report assessment scans.

Procedure

1. Elevate your role to security_admin.
   For more information, see Elevate to a privileged role.
2. Navigate to All > Reports > ACL Assessment for Reports > Report ACL Dashboard.
3. Select Run Assessment Scan.
   The assessment scan can take a long time on instances with many reports. You can choose to view partial results while the scan is in progress, or select View Result when the scan is complete. When the scan is complete, a message shows who ran the assessment and the start and stop time of the assessment.

   Note:

   The scan calculates the number of executions of each affected report. If the property sn_report_acl.run_scan_based_on_report_execution_only is false, the Total Executions column in the Impacted Reports list is always empty, and process_reports_executed_within_X_days_ago is ignored.
   The initial scan shows:

   • The user who executed the scan and the scan's start and end times
   • The number of affected reports
   • The percent of reports on the instance that are affected
   • The number of tables with report_view access control lists
4. Optional: If the affected reports list is empty, navigate to report_executions.list.
   1. If this table is empty, there are no ACL issues.
   2. If the report_executions.list has entries, change the system property sn_report_acl.run_scan_based_on_report_execution_only to false and run the scan again.
      This time, the scan shows all the affected reports, not only those reports that have been executed. The second scan often takes longer to run.
5. Navigate to All > Reports > ACL Assessment for Reports > Affected Reports List to view the list of impacted reports.
   The Impacted Reports list shows the reports affected by ACLs.