> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md).

# Create an incident summary report

In an incident investigation, you can generate an incident summary report in PDF format, which enables you to capture investigation-specific data and share it with team members.

When generating a report, you can do the following:

| Action                                 | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Select a tab to generate a report from | <p>Apart from the War Room, Work Plan, and Evidence Board tabs, you can select which tab to generate a report from including any custom tabs or tabs from a layout installed from a content pack. For example, the Phishing Campaign layout includes the Campaign Overview and Campaign Management tabs. You can select any of those tabs to generate a report.</p><p>When generating a report, you can decide what sections to include from the Case Info tab, by selecting Legacy Summary.</p><p>You can save the reports as templates. Templates cannot be edited after they are created.</p> |
| Create a report from a template        | <p>The Investigation Summary report is included out-of-the-box. This report includes the following sections:</p><ul><li>General information</li><li>Close notes</li><li>Custom data</li><li>Investigation Timeline</li><li>Indicators</li><li>War Room notes</li><li>Evidence timeline and detailed evidence</li><li>Skipped tasks</li><li>Team members</li><li>Linked incidents</li></ul>                                                                                                                                                                                                       |

{% hint style="info" %}

### Tip

If you want a less detailed report, we recommend downloading the **CaseMangement-Generic** content pack which includes a Case Report. This report includes case details, investigation details, labels, closing information, indicators, team members, notes, and any War Room Chat.

The administrator can create a tab in your layout to include any information for reports. For more information about customizing layouts, see [Incident layout customization](/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md).
{% endhint %}

After you create a template, it appears on the **Reports** page under **Incident Reports**.

How to create a summary report

Before you begin, enable popups in your browser.

1. Open the incident for which you want to create a report.
2. Select the tab that has the information you want to appear, and click Actions → **Report**.
3. Select one of the following:
   * To generate a new report, **Select a tab to generate report from**.

     Add the required properties. We recommend the landscape orientation, so that all information is displayed in the report.

     If you choose **Legacy Summary**, select the required sections.
   * To use an existing template, choose **From Template** tab and select the template.
4. If you want to use the report settings as a template, click the **Save report as template** checkbox.
5. Generate the report

{% hint style="info" %}

### Note

You can also use the **`!GenerateSummaryReports`** command in the CLI to generate a report. If you want to automate the process, the administrator can use the **Send Investigation Summary Reports Job** playbook.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.