What is required to automatically attach a report to an incident?

To automatically attach a report to an incident, a SOAR (Security Orchestration, Automation, and Response) license is required. This capability is primarily geared towards enhancing incident response efficiency by integrating automated processes that can generate reports and link them directly with security incidents. The SOAR framework allows organizations to streamline their security operations through automation, facilitating faster decision-making and response to various security threats.

Having a SOAR license enables the necessary integrations and functionality to automate reporting tasks surrounding incidents, whereas other licenses or modules might not provide the same level of automation or direct incident handling capabilities. For example, a FortiGuard license focuses on threat intelligence and updates, a reporting module might provide manual or predefined reporting, and ITSM integration could help in managing incident workflows but does not specifically empower the automatic attachment of reports. Thus, the SOAR license is essential for the seamless and automated handling of reports within incident management processes.