Create an Incident Summary Report - Administrator Guide - 6.10 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Create and generate a custom Incident Summary report in Cortex XSOAR, from the incident page. Save reports as templates.

You can create and customize reports in PDF, CSV and Word formats based on the tabs in the Incident page. This enables you to capture investigation-specific data and share it with team members. You can customize how the information is displayed for existing incidents by modifying the sections and fields for each view. You can add a new tab to an Incident page with the information configured specifically for creating reports.

You can save the reports as templates. Templates cannot be edited after they are created.

A list of the incident Summary Report templates appears in the Reports page under Incident Reports.

From the legacy Summary page, you can select and customize sections to export as a report. See Select and Customize Sections to Export to a Summary Report for details.

  1. Go to the Incidents page and select the incident for which you want to create a report.

  2. Select the tab that has the information you want to appear in a report and click ActionsReport.

  3. To build a new report, from the Build Report tab, select the following:

    • Format

    • Orientation

      It is recommend to use the landscape orientation to ensure that all information displays in the report.

    • Paper Size

      If you want to use the setting as a template, click the Save report as template check box.

  4. To use an existing template, from the Select a Template tab, select the template.

  5. To generate the report, click Generate report or use the following in a Playbook or as a CLI command:

    !GenerateSummaryReports name="<template name>" type="<report type>" ids="<Incident ID>"