Incident PDF and Autopsy Report

Incident PDF and Autopsy report

Petra can generate PDF reports for incidents and, for tenants that have had an Autopsy, a full Autopsy report. These give you a shareable, client-ready summary of what happened and what was done. This article explains what each report is and when you'd use it.

Incident PDF

For a single incident, you can generate a PDF that summarizes that incident: the affected user, what was detected, the timeline, blast radius (what was accessed or sent), and the remediation actions taken. The incident PDF is useful for sharing with the affected user's manager, for customer communication when you're an MSP, or for your own records and compliance. You typically trigger it from the incident detail view; once generated, you can download and share it. The content is based on what's in Petra for that incident—no technical or internal implementation details, just a clear summary of the finding and the response.

Autopsy report

An Autopsy is a one-time historical analysis of a tenant (see "Autopsy vs active monitoring" for the full picture). When the Autopsy is complete, Petra produces an Autopsy report—a PDF that covers the entire look-back period. It summarizes what Petra found: current or past attackers, how they got in, what they accessed, and often metrics such as time to detection and time to containment. The report is designed to be client-ready so you can hand it to the customer or management as a security assessment. You can download the Autopsy report from the tenant or reporting area when it's ready, usually within 24 to 48 hours after the Autopsy run.

When to use which

Use an incident PDF when you need to document or share a single incident—for example, after you've remediated a compromise and want to give the business a concise summary. Use the Autopsy report when you need a full historical picture of a tenant, such as after onboarding a new client or when doing a one-time security review. Both are meant to be customer-facing and actionable, so you can use them in communications and reports without exposing internal or technical details.