See what a professional incident evidence pack looks like
Request a sample CasePack evidence pack or book a 20-minute workflow review to see how CasePack fits next to your PSA, SIEM, EDR, or existing incident process.
Works beside your PSA
Turn HaloPSA incident tickets into client-ready evidence packs
CasePack helps MSPs using HaloPSA-style ticket workflows create structured incident records, collect evidence, build timelines, generate reports, and export professional PDF/ZIP evidence packs.
Keep HaloPSA for service workflow. Use CasePack for incident packaging.
Your PSA is still the right place for service tickets, operational workflow, assignment, SLA context, and day-to-day work management. CasePack adds the incident evidence and reporting layer that MSPs need after or during the response:
- tenant-scoped incident workspace
- evidence vault
- timeline of key actions and decisions
- NIS2 milestone tracking where relevant
- report templates
- audit log
- evidence pack exports
HaloPSA-style workflow with CasePack
- 1
Incident ticket starts in HaloPSA
A ticket is created from a client report, alert, triage workflow, or security process.
- 2
Create a CasePack incident through webhook intake
CasePack supports webhook intake for HaloPSA-style payloads. For HaloPSA payloads, CasePack maps common fields like summary to incident title, details to incident description, and priority_name to severity where available.
- 3
Add the evidence that does not belong buried in ticket comments
Upload screenshots, logs, IOCs, PDFs, exports, emails, endpoint data, or other supporting files.
- 4
Build a chronology of the response
Use the timeline to capture containment, eradication, recovery, client communication, and analyst notes.
- 5
Generate a report and evidence pack
Produce an executive/client summary, final evidence pack, or NIS2-style notification report where relevant.
What the client receives
Instead of sending a raw ticket thread, your MSP can provide:
- a clean executive summary
- clear timeline of events
- evidence index
- remediation and recommendations
- root cause and lessons learned
- PDF report
- ZIP evidence pack where appropriate
- audit history related to the incident
Why this improves MSP delivery
Security incidents are high-trust moments. A professional close-out package helps your team show the work, reduce confusion, and demonstrate a repeatable process.
CasePack makes the report and evidence workflow easier to standardize across technicians and clients.
Webhook setup summary
- 1
In CasePack, open the target tenant workspace
- 2
Navigate to Webhooks
- 3
Create a new webhook and select HaloPSA as provider
- 4
Copy the generated webhook URL
- 5
Configure the HaloPSA-side automation or integration to send incident data to CasePack
- 6
Test with a low-severity sample incident
Security note: Treat the webhook URL as a secret and rotate it if exposed.
Add evidence packaging to your HaloPSA workflow
CasePack helps your MSP turn incident tickets into structured records with evidence, timelines, reports, audit logs, and exports.
Frequently asked questions
No. CasePack complements PSA workflows by focusing on incident evidence, timelines, reports, audit logs, and evidence pack exports.
CasePack supports tenant-scoped webhooks that can create incidents from HaloPSA-style payloads.
CasePack documentation describes mapping summary to title, details to description, and priority_name to severity where available.
Yes. HaloPSA can remain the operational ticketing workflow while CasePack is used to package the security incident record.
No. HaloPSA is a third-party product and trademark of its respective owner. CasePack is not affiliated with or endorsed by HaloPSA.
Related pages
MSP Evidence PacksTurn scattered incident notes, logs, screenshots, and PSA tickets into client/auditor-ready evidence packs for MSP security incidents.Client-Ready ReportsGenerate professional client-ready incident reports from incident details, timelines, evidence, impact notes, remediation steps, and audit history.ConnectWiseUse CasePack with ConnectWise-style PSA workflows to turn tickets and alerts into incident timelines, evidence packs, reports, and audit-ready exports.AutotaskUse CasePack with Autotask-style PSA workflows to convert incident tickets into structured evidence, timelines, reports, audit logs, and exports.Sample Evidence PackRequest a sample CasePack incident evidence pack and see how MSPs can package timelines, evidence, reports, audit history, and client-ready outputs.
HaloPSA is a trademark of its respective owner. CasePack is not affiliated with or endorsed by HaloPSA.