Check Defender incident PDF coverage and freshness before using it as evidence

Source facts

Defender’s incident PDF includes up to ten impacted assets of each asset type and up to one hundred evidence items. The export dialog lets the operator include or exclude incident information, with everything selected initially. A generated report is cached briefly, so exporting the same incident again soon can return the earlier PDF; Microsoft advises waiting a few minutes for a newer version. Microsoft Learn.

Applicability

Apply this review when a PDF is used for handoff, offline analysis or an investigation record. Distinguish the exported presentation from a claim that every asset and evidence item in the live incident is present.

DSE recommendation

Record the PDF’s selected sections, coverage limits and generation time alongside the incident reference. Ask the investigator to identify any material evidence outside the displayed limits and preserve an authorized reference to it separately. After significant incident updates, do not repeatedly download the file and assume each download represents newly generated content. Keep the original export when it forms part of the investigation history.

Verification

Compare the exported asset and evidence lists with the incident’s current scope, especially where a category exceeds the documented cap. Inspect the report after the cache interval when a refreshed version is required, and confirm that the intended recent change appears. Label differences as omitted coverage, operator-selected exclusions or an earlier snapshot rather than treating every mismatch as lost incident data. Retain the comparison with the handoff.

Official references

Microsoft Learn: Managing incidents and exporting PDF data. Source reviewed September 9, 2026.