Microsoft Excel summary workbooks include preconfigured PivotTables designed specifically for Threat Manager investigations. Keep the following in mind when reviewing or sharing these files.

Automatic refresh behavior

PivotTables in Threat Manager exports are configured to refresh automatically when the workbook is opened. This ensures the analysis reflects the full exported dataset.

• For large alerts, the initial refresh may take several moments.

• Allow the refresh to complete before interacting with the workbook.

Save prompt on close

Because PivotTables refresh on opening, Microsoft Excel may prompt you to save the file when closing, even if you didn't make manual changes. This is expected behavior. Saving preserves the refreshed PivotTable state.

Field availability is export-dependent

Only fields included in the Threat Manager export are available in PivotTables.

• If a field (for example, MatterID) appears in the PivotTable Field List, it can be added immediately.

• If a field doesn't appear, it wasn't included in the export and can't be added later in Microsoft Excel.

Performance considerations

PivotTable performance depends on alert size and activity volume.

• Alerts with high document or activity counts may take longer to load.

• Avoid interacting with PivotTables while they are refreshing.

Preventing accidental PivotTable changes (optional)

When sharing workbooks with stakeholders, you may want to reduce the risk of accidental changes.

• The PivotTable Fields pane can be hidden to simplify the view.

• This does not affect the underlying data or saved analysis and can be toggled on or off at any time.