---
title: Reports in Security Incident Response
description: All the reports associated with a security incident are available within the Reports section for analysis and sharing.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/report-templates-sir.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Working with Security Incident Records, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Reports in Security Incident Response

All the reports associated with a security incident are available within the Reports section for analysis and sharing.

The analyst will be able to:

-   [Create a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/create-report-sir.md)
-   [Edit a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/edit-report-sir.md)
-   [Delete a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/delete-report-sir.md)

-   **[Create a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/create-report-sir.md)**  
Analysts can create a report in Security Incident Response to include the status of an incident and share it via email.
-   **[Edit a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/edit-report-sir.md)**  
Analysts can modify an unpublished report in Security Incident Response and share it via email.
-   **[Delete a report](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/delete-report-sir.md)**  
You can delete a report in Security Incident Response which is in published or draft state.

**Parent Topic:**[Working with Security Incident Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/using-analyst-workspace.md)

**Related topics**  


[Security Incident Overview section]()

[Security Incident Details section]()

[SIR Workspace Orchestration]()

[Security Incident Response Tasks]()

[Security Incident Response Other Records]()

[Security Incident Response Post Incident Review]()

[Update information in security incident related records]()

[TISC integration within SIR Workspace]()

[Collaborate using conference call or chat in Security Incident Response]()

[Viewing incident details with a relationship graph]()

[MITRE attack and defend technique graph]()

[View and filter the incident timeline]()