Free tool
Incident Log & Report
One place to document a security or IT incident from first report to closure: a timeline, checklists for each phase, evidence, notifications, costs, and a finished incident report you can print or share.
🔒 Everything stays in this browser — nothing is uploaded. Back up to a file regularly: clearing your browser data deletes what's here.
Don't record secrets. Never type passwords, secret keys, or full card, bank-account or ID numbers into this log. Use the last four digits or a reference number instead.
🔒 Saved only in this browser.
How it works
- Start logging straight away. Use the "Log to the timeline" bar on every tab to record what happened, with the current time, in a few seconds. Tidy up the wording later.
- Work through the checklists. Each phase has practical steps, plus extra ones for the incident type you choose. Mark items done or not applicable; the tool records who and when, and can add them to the timeline.
- Keep the facts in one place. Affected systems, evidence and its chain of custody, who was notified, decisions, actions, and costs all go into the same record.
- Print the report. The Report tab builds a full incident report and a one-page executive summary. Empty sections are left out.
- Several incidents, one browser. Create, duplicate or delete incidents with the switcher at the top. Back up to a file to keep a copy or hand the record to someone else.
- Prepare before the next one. Write your plan with the free Incident Response Plan Builder, and practise it with the Tabletop Exercise Builder.
This tool helps you keep records; it isn't legal advice. Follow your incident response plan, your cyber insurer's instructions, and your counsel. Whether, when and how you must notify anyone depends on your laws, contracts and locations — confirm deadlines with counsel, your insurer and your contracts.