Case ManagerTrack and Maintain Security Incidents

Table of Contents

Export a List of Incidents to CSV

To audit incidents, give details about incidents to people outside of your SOC, or archive and back up incident data to your local environment, apply a filter to export a list of incidents to a CSV file.

The CSV file contains one incident per row and all relevant incident fields. It only includes an incident's ten most recent case notes. You can export a maximum of 10,000 incidents at a time. If you have no incidents, exporting is disabled.

  1. On the INCIDENTS page, click EXPORT.

  2. Specify the incident fields you want exported.

    • To include specific fields in the template, click + next to the field. To find a specific field, start typing in the search.

    • To include all fields, click CLICK ALL.

    • To export fields predefined in a template, click ALL TEMPLATES, then select a template.

  3. Click EXPORT.

  4. Download the CSV file.

Create a Template for Exporting Incidents

To save time when you export incidents, create a template with the incident fields you export most often.

  1. On the INCIDENTS page, click EXPORT. Ensure that ALL TEMPLATES is selected.

  2. Specify the incident fields you want exported. To include specific fields in the template, click + next to the field. To find a specific field, start typing in the search. To include all fields, click ADD ALL.

  3. Select Save As.

  4. Name the template, then press Enter or return on your keyboard. The template is created.

  5. To use the template you created to export incidents, click EXPORT.

Edit a Template for Exporting Incidents

Make changes to an existing template you created.

  1. On the INCIDENTS page, select EXPORT.

  2. Click ALL TEMPLATES, then select the template you want to edit.

  3. Add or remove incident fields from the template.

  4. Click Save. The template is updated.

  5. To use the template you edited to export incidents, click EXPORT.

Delete a Template for Exporting Incidents

If you created a template for exporting incidents, you can also delete it.

  1. On the INCIDENTS page, select EXPORT.

  2. Click ALL TEMPLATES, then select the template you want deleted.

  3. Click the down arrow, then select Delete.

  4. Click DELETE.