Skip to content

Evidence Pack Export

Evidence Pack Export lets you generate a downloadable package of an incident’s documentation — suitable for sharing with clients, auditors, and regulatory authorities.

  1. Open the incident detail page
  2. Navigate to the Exports tab
  3. Click Export PDF or Export ZIP
  4. The export is queued and processed in the background
  5. Download the file when the status is Completed

If your plan doesn’t include Evidence Pack Export, you’ll see an upgrade prompt. See Licensing & Access States.

A structured document containing:

  • Incident summary (title, severity, status, description)
  • Timeline of events
  • NIS2 milestone status (if enabled)
  • Evidence inventory (filename, upload date, uploader)
  • Metadata and timestamps

A compressed archive containing:

  • All evidence files in their original format
  • manifest.json — Machine-readable metadata:
    • Incident details
    • Evidence file listing with hashes
    • Milestone status
    • Export timestamp

The Exports tab shows all previous exports for the incident:

ColumnDescription
FormatPDF or ZIP
StatusPending, Generating, Completed, or Failed
Export IDTruncated export identifier
ActionGenerating indicator, Download button, or failure message
StatusDescription
PendingExport request received, waiting to be processed
GeneratingExport is being generated
CompletedExport is ready for download
FailedExport generation failed (retry by creating a new export)

CasePack refreshes pending and generating exports automatically until the export completes or fails.

  • Read-Only Expired — Existing exports can be downloaded, but no new exports can be created
  • Export Only — A dedicated Export Data page lists all exports across all incidents for bulk download

See Licensing & Access States.

  • Use PDF exports for client-facing reports
  • Use ZIP exports for auditors who need the raw artifacts
  • Create exports before closing an incident for a complete package
  • Re-export after adding new evidence to include everything
  • Exports are immutable — each request creates a new snapshot
  • Evidence — Managing evidence artifacts
  • Incidents — Incident details included in exports
  • Milestones — Milestone status included in exports