Skip to content

Incident Reports

Incident Reports let you generate professional, structured reports from your incident data, timeline, and evidence. Choose from built-in templates tailored for different audiences — from quick triage summaries to regulatory notifications.

If your plan doesn’t include Incident Reports, you’ll see an upgrade prompt. See Licensing & Access States.

  1. Open an incident detail page
  2. Click the Reports tab

The Reports tab displays a template grid and a table of previously generated reports.

CasePack includes four built-in templates:

TemplateCategoryDescription
Initial Triage ReportIntakeCapture essential facts and assign ownership in the first stage of the incident.
Executive / Client SummaryStakeholderA concise stakeholder-ready summary of what happened, what was impacted, and what was done.
Final Evidence PackClosureClosure-ready export with timeline, evidence index, response actions, root cause, and sign-off.
NIS2 Incident NotificationRegulatoryStructured 24h, 72h, progress, or final notification based on current incident data.

CasePack automatically recommends templates based on the incident’s current state:

  • Status — e.g., an Initial Triage report is recommended for Open incidents
  • Severity — higher severity incidents surface the Executive Summary template
  • NIS2 Reporting — if NIS2 reporting is enabled, the NIS2 Notification template is recommended

Recommended templates display a ✦ Recommended badge in the template grid.

  1. Click a template card in the Reports tab
  2. The Report Builder sheet opens on the right side
  3. Select the output format:
    • PDF — A downloadable document suitable for sharing with stakeholders
    • HTML — An in-app viewable report you can preview or print
  4. Optionally fill in Content Overrides (see below)
  5. Click Generate PDF or Generate HTML

The report is queued and processed in the background. Progress is shown in the Generated Reports table with auto-polling until complete.

Each template defines editable sections that let you add or replace content in the generated report. Leave a field blank to use auto-generated content from incident data.

FieldPurpose
Executive SummaryBrief overview of the incident and initial findings
Immediate ActionsContainment actions taken or required
FieldPurpose
Executive SummaryNarrative paragraph about the incident
Business & Client ImpactImpact on operations, data, clients, or revenue
Remediation StepsCompleted and planned remediation actions
RecommendationsStrategic recommendations for preventing recurrence
FieldPurpose
Root Cause AnalysisDetailed root cause analysis and attack chain
Lessons LearnedKey lessons and process improvements identified
Sign-Off NotesClosure notes and approver comments
FieldPurpose
Notification Typee.g., 24h Early Warning, 72h Notification, Final Report
Cross-Border ImpactImpact on other EU member states
Additional Regulatory NotesSupplementary notes for the competent authority

Before generating, you can preview a report in HTML format:

  1. In the Report Builder sheet, click Preview
  2. A dialog opens with a sandboxed HTML preview of the report
  3. Use the Print button to print directly from the preview

Content overrides are included in the preview, so you can verify your custom content before generating.

The Generated Reports table shows all reports created for the incident:

ColumnDescription
TemplateTemplate name with icon
StatusPending, Generating, Completed, or Failed
FormatPDF or HTML
ActionsPreview (HTML) and Download buttons
  • Pending/Generating reports show a spinner with “Generating…”
  • Completed reports offer Preview and Download buttons
  • Failed reports display an error message

The report generator uses the same export job status values as evidence packs: PENDING, GENERATING, COMPLETED, and FAILED.

  • Use the Initial Triage template immediately when an incident is opened to capture first impressions
  • The Executive Summary is ideal for client-facing communication — fill in the Business Impact override for specificity
  • Generate the Final Evidence Pack before closing an incident to ensure a complete audit trail
  • For NIS2-regulated incidents, generate notifications at each milestone deadline (24h, 72h, final)
  • Preview reports before generating PDFs to verify content overrides look correct