Adding reports to an incident
Reports can be attached to incidents to include historical data relevant to that incident.
Reports can be added to incidents through the following methods:
- Reports can be manually added by an admin from the Reports module or from the incident's Analysis page.
- Reports can be automatically added to an incident by a FortiSoC playbook. See FortiSoC.
Once a report has been attached to an incident, it can be viewed, managed, and downloaded from the Reports tab on the incident's Analysis page. Multiple reports can be attached to a single incident.
To attach reports from an incident:
- Go to FortiSoC/Incidents & Events > Incidents, and select an incident.
- Click on the Reports tab in the incident analysis page, and click Add.
- Select one or more previously generated reports, and click OK.
To attach reports from the Reports module:
- Go to Reports > Generated Reports.
- Right-click on a report, and select Attach to Incident.
- Select an incident from the list, and click Add to this incident.