INTRODUCTION

In a real SOC environment, building dashboards is only half the job.
The other half is presenting findings clearly to stakeholders such as managers, CISOs, and executives.

One of the most common ways to do this is by exporting dashboards into PDF reports.

This guide explains how to export Splunk dashboards into clean, professional, executive-ready PDF reports — step by step.

---

WHY PDF EXPORT IS IMPORTANT

Exporting dashboards to PDF helps in:

• Sharing findings with non-technical stakeholders
• Creating audit and compliance reports
• Documenting security incidents
• Presenting detections in a structured format
• Building a professional SOC portfolio

An executive does not read raw logs — they read clean reports.

---

STEP 1 — PREPARE YOUR DASHBOARD (VERY IMPORTANT)

Before exporting, ensure your dashboard is clean.

Checklist:

• Panel titles clearly describe the detection
• MITRE mapping is included in the description
• No unnecessary columns
• Results are readable (not cluttered)
• Time range is correctly selected

Example:

✔ “13. SOC L3 – Windows Attack Technique Detections — MITRE T1021”
❌ “Test Panel 1”

---

STEP 2 — OPEN YOUR DASHBOARD

Go to:

Splunk → Dashboards →
Open your dashboard:

SOC L3 – Windows Attack Technique Detections

---

STEP 3 — SELECT TIME RANGE

At the top right:

Choose appropriate time range:

• Last 24 hours (for daily reports)
• Last 7 days (for weekly reports)
• All time (for lab/demo purposes)

This is critical because your PDF will reflect this data.

---

STEP 4 — EXPORT TO PDF

Click:

👉 “Export” (top right corner)

Then select:

👉 “Export PDF”

---

STEP 5 — CONFIGURE PDF SETTINGS

Splunk will open PDF options.

Important settings:

• Paper Size: A4
• Orientation: Portrait (or Landscape if wide tables)
• Include Title: Yes
• Include Description: Yes

These settings ensure your report looks professional.

---

STEP 6 — DOWNLOAD AND REVIEW

Click:

👉 Generate PDF
👉 Download file

Now review:

• Are titles visible?
• Is MITRE mapping readable?
• Are tables aligned properly?
• Is content cut off?

If anything looks wrong → adjust dashboard and re-export.

---

STEP 7 — MAKE IT EXECUTIVE-READY

This is where most people fail — you won’t.

To make your PDF professional:

✔ Use clear titles

Example:

“12. SOC L3 – Windows Attack Technique Detections — MITRE T1562.001”

---

✔ Keep only important fields

Avoid clutter:

✔ Time
✔ User
✔ Host
✔ Command

---

✔ Add MITRE mapping in description

Example:

T1562.001 — Disable Security Tools
This detection identifies attempts to stop antivirus or security services.

---

✔ Avoid raw technical noise

Executives want:

👉 What happened
👉 Why it matters

Not raw logs.

---

STEP 8 — COMMON MISTAKES TO AVOID

❌ Exporting cluttered dashboards
❌ Missing titles or descriptions
❌ Too many columns
❌ No MITRE mapping
❌ Wrong time range
❌ Unformatted tables

---

STEP 9 — ADVANCED TIP (SOC L3 LEVEL)

Create separate PDFs for different purposes:

• Daily SOC report
• Weekly threat summary
• Incident-specific report

You can even:

• Combine multiple dashboards
• Create structured reporting templates

This is exactly how enterprise SOC teams operate.

---

STEP 10 — USING PDF FOR YOUR PORTFOLIO

This is where YOU gain advantage.

Use your exported PDFs to:

• Show recruiters your work
• Add to your website (raj-consultancy.com)
• Share on LinkedIn
• Attach in job applications

This proves:

👉 You don’t just detect
👉 You can present like a professional

---

FINAL THOUGHT

Exporting dashboards is not a small skill.

It shows:

• Communication ability
• Professional maturity
• Understanding of business context

This is what separates SOC L1 from SOC L3.