Create an Incident Summary Report - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Create and generate a custom Incident Summary report in Cortex XSOAR, from the incident page. Save reports as templates.

You can create and customize reports in PDF and CSV formats based on the tabs in the Incident page. This enables you to capture investigation-specific data and share it with team members. You can customize how the information is displayed for existing incidents by modifying the sections and fields for each view. You can add a new tab to an Incident page with the information configured specifically for creating reports.

You can save the reports as templates. Templates cannot be edited after they are created.

A list of the incident Summary Report templates appears in the Reports page under Incident Reports.

  1. Go to the Incidents page and select the incident for which you want to create a report.

  2. Select the tab that has the information you want to appear in a report and click ActionsReport.

  3. To build a new report, from the Generate Report tab, select the following:

    • Format

    • Orientation

      We recommend the landscape orientation to ensure that all information displays in the report.

    • Paper Size

  4. Select and customize sections from the Summary page to include in the report.

  5. If you want to use the setting as a template, click the Save report as template checkbox.

  6. To use an existing template, choose From Template tab and select the template.

  7. To generate the report, click Generate report or use the following in a Playbook or as a CLI command:

    !GenerateSummaryReports name="<template name>" type="<report type>" ids="<Incident ID>"