Export a case file
Hand an incident to someone outside the deployment as a marked PDF case file. The export is hashed, listed with its manifest, written to the delivery ledger and recorded in the audit log, and it asks for approval whenever the rules require it.
On this page9
A case file is the report on marked pages: the finding, the sequence and every excerpt with the file, location and SHA-256 it came from. The limitations and open questions travel with it under your program's marking. Coordinates come out by default.
The export dialog on the incident page covers the case file and every other export format. "Every export is hashed, written to the delivery ledger and recorded in the audit log."
Before you start#
- Admins, investigators, reviewers and auditors can export case files. Viewers cannot. See Roles and permissions.
- Run the Before you export checklist on the Report tab and settle each warning. See Write and review a report.
- For a case file with the reviewer's sign-off, the reviewer has approved the report. Without it, the case file is stamped DRAFT on every page.
- Confirm the marking. Admins set it in Settings, under Marking. See CUI marking.
Export the case file#
Open the dialog
Select Export in the incident header. On the Report tab, Export case file at the foot of the Review and history drawer opens the same dialog. On the Exports tab of Integrations, New export asks for the incident, then opens it too. It is titled Export incident, such as Export INC-0142.
Keep the format
Under Formats, PDF case file with CUI markings is ticked, with its class, L1. It holds "The report, with CUI in the banner and footer of every page and the designation indicator on the first." Ticking any other format adds evidence and makes the export L2, which needs a named approver; see Export formats and evidence bundles.
Choose the destination
Destination What the dialog says Download "Saved by your browser on this workstation." Exports bucket, selected when the dialog opens Your exports bucket, "in this account. Kept for the retention period in Settings." On-premises share Your share, "on your network." Removable media "An encrypted drive written at the media station, for hand carry out of the enclave." The first three read Inside the enclave. Removable media reads Leaves the enclave.
Read the approval
Approval shows the class, "L1, a summary with values. Treat it as CUI." Inside the enclave it reads "No approval needed. L1 stays inside the enclave."
It then states the sign-off. An approved report reads "The report is approved, so the case file carries the reviewer's sign-off." Otherwise it names the reviewer: "The report has no sign-off from" the reviewer "yet, so the case file is stamped DRAFT on every page."
Set the options
Options Default What the dialog says Remove coordinates On while the redaction policy is on "From derived files and the case file. Originals stay byte-identical, so they keep theirs." Portion marks Off "Mark each paragraph (CUI) or (U) in the case file. Optional under 32 CFR 2002.20." Check the marking
Marking shows the marking chip, such as CUI, and the designation, such as "Category EXPT, FEDCON, controlled by" your organization. Under an UNCLASSIFIED banner it reads No CUI designation.
The hint says: "L1 and L2 files carry the banner string. The case file prints it at the top and bottom of every page, with the designation indicator on the first."
Export
The footer reads "1 file and a SHA-256 manifest". Select Export, and the toast names the export and its manifest hash, for example Exported PDF case file with CUI markings as EXP-0035.
What the export records#
| Where | What it shows |
|---|---|
| Incident Activity tab | Your name and "exported PDF case file with CUI markings", with ", stamped DRAFT" when it applies and the export ID |
| Audit log | Exported case file on the incident, with the export ID, the format, ", stamped DRAFT" and ", coordinates removed" when they apply |
| Integrations, Exports tab | The export, its destination, Completed and "No approval needed", or "No approval needed. Stamped DRAFT" |
| Integrations, Delivery ledger tab | The delivery, class L1, with the manifest as its payload and its SHA-256 |
The file is named for the incident: inc-0142-case-file.pdf, or inc-0142-case-file-draft.pdf when it is stamped DRAFT. In the example dataset, EXP-0033 is the draft case file for INC-0137, downloaded with coordinates removed.
When the case file leaves the enclave#
A case file for Removable media leaves the enclave, so the two-person rule applies: "both named approvers sign off, and neither can be you." The dialog lists both approvers and asks for a Reason, "Who needs it, and why". The button reads Request approval.
The request writes nothing yet. Its toast reads, for example, "EXP-0035 is waiting for" both approvers, then "Nothing is written until both approve."
The audit log records Requested export, and the activity reads "requested an export". The Exports tab shows Waiting for approval until both have signed the manifest.
What the recipient receives#
The case file follows the report, part by part:
| Part | What it holds |
|---|---|
| Marking | The marking at the top and bottom of every page, with the designation indicator on the first: Controlled by, the office, CUI category, Dissemination and POC |
| Header | Incident report, the ID and title, then Vehicle, Run, Location, Sources, Clock, Investigator, Reviewer and Generated |
| Sources | Each original file by name, with its SHA-256 |
| 1 Finding | The engineer's paragraph and its level, with who wrote it and when |
| 2 Sequence | The events in time order, each with its bound, level and evidence reference |
| 3 Evidence | For each reference: file, location, SHA-256, parser, event ID and the excerpt |
| 4 Limitations | Missing data, clock uncertainty, latency, scope and manual assumptions |
| 5 Open questions | Every question still open |
| 6 Next check | The test or measurement that would confirm or refute the finding |
| Footer | "Generated by Foxborne 1.4.2. Every excerpt can be checked against its SHA-256." |
Without the reviewer's sign-off, every page carries the DRAFT stamp. With coordinates removed, positions are stripped from the case file, and the Location line loses the position the console marks Removed on export. With copies of the originals, the recipient can check every excerpt: see Verify a report against the originals.
Coordinates and the redaction policy#
Flight logs carry positions, and the Import files page says so: "Flight logs contain positions. Exported reports remove coordinates unless the exporter turns them back on."
| Control | Where | What it does |
|---|---|---|
| Remove coordinates on export | Settings, under Redaction | The policy: "Positions are removed from exported reports unless the exporter turns them back on." An admin switches it |
| Remove coordinates | The export dialog | Starts from the policy. The exporter can turn it off for one export |
| Before you export | Review and history, on the Report tab | Reads "Coordinates are removed on export", or warns "Coordinates will be included on export" |
Switching the policy confirms with Coordinates will be removed on export or Coordinates will be kept on export. The audit log records Changed redaction, with "Coordinates on export: removed" or "Coordinates on export: kept".
Two more redaction settings act earlier, on the vehicle. Patterns removed from logs is "Applied on the vehicle before upload", and Process arguments and environment reads Never collected. See Retention, holds and redaction.
Check the result#
- The toast names the export ID and the manifest SHA-256.
- The incident's Activity tab lists the export with your name.
- The Exports tab lists it as Completed; its drawer shows the manifest, and Ledger entry opens the delivery.
- The audit log shows Exported case file with the export ID and, under the policy, ", coordinates removed".
Troubleshoot#
The case file is stamped DRAFT. The reviewer has not approved the report yet. Export again once the report is approved; see Write and review a report.
The button reads Request approval. You ticked a format other than the PDF, or chose Removable media. Untick the extra formats and choose a destination inside the enclave, or fill in the Reason and request approval.
The marking reads No CUI designation. The banner is set to UNCLASSIFIED in Settings. If the incident carries CUI, an admin changes it under Marking.
Before you export warns Coordinates will be included on export. The redaction policy is off. Tick Remove coordinates in the dialog, or ask an admin about the policy.
You cannot export. The viewer role has no export permission. Ask an admin for a role with Export case files.