To generate a report for an incident, you must have:
Access to the tenant to which the incident belongs.
One of the following XDR roles: Main administrator, SOC administrator, Tenant administrator, Junior analyst, Tier 1 analyst, Tier 2 analyst, SOC manager, Approver, Auditor.
To generate and export a report:
In the main menu, go to Monitoring & reporting → Incidents.
In the toolbar, click the Export button, and then, in the drop-down menu, select one of the following:
Effort report to export a report on the effort spent by analysts when working with an incident.
Incident metrics report to export a report on the incident compliance to SLA metrics.
In the right pane that opens, specify the period for which you want to display the data in the report. To do this, select the date and time in the From and To fields.
By default, in the From field the first day of the current month is selected for Effort reports, and the current date is selected for Incident metrics reports. The time is set to 00:00 for both types of reports.
In the To field, the current date is selected, and the time is set to 23:59.
If necessary, specify the other settings, depending on the type of report that you selected at step 3:
For the Effort report:
Select analysts or user groups if you want the report to include the incidents that required the efforts of the users that you specify.
Enable the Include incident ID and effort category details toggle switch if you want the effort report to contain these details.
By default, the toggle switch is disabled.
For the Incident metrics report:
Select the priorities of the incidents to be included in the report. Possible values: Low, Medium, High, Critical.
Enable the Export only incidents with SLA breaches toggle switch if you want to include in the report only the incidents with SLA breaches.
An incident is included in the report if it has at least one expired SLA entry. The SLA entry is considered expired when at least one of its lime limits (Time to triage, Time spent to respond, or Time to resolve) is less than 0.
Click the Export button.
The pane closes, and the report is generated and downloaded to your computer.