The same Nanolog that streams fields to your SIEM also feeds an audience that will never open a : the analyst mid-investigation, the manager tracking a trend, the executive who wants one page. Zscaler Internet Access () serves them through a reporting layer whose forms map to those readers - and knowing which form answers which question is the difference between reporting as insight and reporting as wallpaper. This article stays deliberately at the shape level: the analytics surface evolves, so the durable knowledge is what each form is for - the specific navigation lives in the product's own documentation, where this series always sends you for click-paths.
The forms and their readers
Interactive reports are the analyst's instrument: aggregate views over the logged traffic - by user, location, category, application, threat class - that expand on click, so the loop of notice, narrow, notice again runs at reading speed instead of query speed. The bandwidth dashboards this series met in the locations article are the same idea aimed at capacity. Scheduled reports put the calendar in charge: the same aggregates, generated and delivered on cadence - the Monday-morning artifact that keeps a trend observed without anyone remembering to observe it. Dashboards are ambient state for the wall and the standup. And the executive summary is its own discipline more than its own feature: the period's traffic, blocks, threat encounters, and usage shifts compressed into the few sentences a leadership audience will actually metabolize - the form where every number needs a verb.
Usage over time is a reporting question
A recurring operational instinct deserves correcting in both directions. Questions of record - what exactly did this user fetch at 14:32, with which rule label - belong to the log fields and the SIEM; a report's aggregates cannot answer them. But questions of trend - is streaming media's share of branch bandwidth growing, did blocks spike after the policy change, which locations' usage justifies a bigger tunnel - belong to the reporting layer, and answering them by grepping raw logs is rebuilding, badly, what the platform already computes. The audit discipline pairs naturally: when a usage trend bends at a date, the admin audit log says what changed that day, and the report-plus-audit pair is the whole story - what moved, and whose hands moved it.
The honest boundaries
Three keep expectations calibrated. Reporting reads what logging wrote: a category of traffic that never transits the platform, or transits uninspected, is invisible to every form above - the reporting layer inherits inspection's blind spots rather than transcending them. Retention is the platform's, not yours: trends beyond the platform's memory belong to the SIEM archive the streaming article built. And an executive summary is an editorial act - the platform can generate the numbers, but choosing which three of them matter this quarter is the operator's judgment, which is exactly why the summary that leadership trusts is the one a human signed.