Adding reports to an incident

Reports can be attached to incidents to include historical data relevant to that incident.

Reports can be added to incidents through the following methods:

1. Reports can be manually added by an admin from the Reports module or from the incident's Analysis page.
2. Reports can be automatically added to an incident by a FortiSoC playbook. See FortiSoC.

Once a report has been attached to an incident, it can be viewed, managed, and downloaded from the Reports tab on the incident's Analysis page. Multiple reports can be attached to a single incident.

To attach reports from an incident:

1. Go to Events & Incidents/FortiSoC > Incidents, and select an incident.
2. Click on the Reports tab in the incident analysis page, and click Add.
3. Select one or more previously generated reports, and click OK.

To attach reports from the Reports module:

1. Go to Reports > Generated Reports.
2. Right-click on a report, and select Attach to Incident.
3. Select an incident from the list, and click Add to this incident.