--- title: After Actions Report slug: connectors/after-actions-report docTags: createdAt: 2026-06-09T16:30:06.249Z --- After Actions Report is a platform for generating structured, comprehensive reports documenting incident responses and findings. After Actions Report enables organizations to generate comprehensive incident documentation, capturing all critical details and findings following a security event. This connector allows Swimlane Turbine users to automate the creation of detailed After Action Reports directly from their playbooks, leveraging customizable templates and dynamic data fields. By integrating After Actions Report with Turbine, security teams can streamline post-incident reporting, ensure consistency in documentation, and accelerate compliance and knowledge sharing across the organization. ## Prerequisites To use the After Actions Report connector, ensure you have the following prerequisites: - Personal Access Token authentication using these parameters: - Swimlane URL: The base URL of your Swimlane instance. - Swimlane API PAT: A valid Personal Access Token for authenticating API requests. ## Capabilities This Connector provides the following capabilities: - Create After Actions Report # Configurations ## Asset Authenticates using an Personal Access Token ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------------ | ------------------------------------------------------------------------------------------------- | -------- | ------------ | | swimlane\_url | Internal URL of your Swimlane Instance, i.e. 'sw-web:443', 'sw-web:4443' or FQDN of Load Balancer | string | Required | | swimlane\_api\_pat | Personal Access Token (PAT) used when accessing the Swimlane API. | string | Required | | default\_timeout | Connection timeout in seconds. Defaults to 60 seconds | number | Optional | | verify\_ssl | Enable SSL certificate verification. Ignored for non-SSL connection | boolean | Optional | | verbose\_errors | HTTP errors will contain more detail about the request and response if selected. | boolean | Optional | # Actions ## Create After Action Report Generate a comprehensive After Action Report for an incident, documenting all relevant details and findings. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `event_source` | string | Optional | Parameter for Create After Action Report | | `tracking_id` | string | Optional | Unique identifier | | `case_summary` | string | Optional | Parameter for Create After Action Report | | `soc_analysis` | string | Optional | Parameter for Create After Action Report | | `event_occurred_on` | string | Optional | Parameter for Create After Action Report | | `event_received_on` | string | Optional | Parameter for Create After Action Report | | `case_created_on` | string | Optional | Parameter for Create After Action Report | | `case_claimed_on` | string | Optional | Parameter for Create After Action Report | | `case_closed_on` | string | Optional | Parameter for Create After Action Report | | `case_tt_closed_min` | string | Optional | Parameter for Create After Action Report | | `case_current_owner` | string | Optional | Parameter for Create After Action Report | | `analyst_phone` | string | Optional | Parameter for Create After Action Report | | `user_account` | string | Optional | Count value | | `hostname` | string | Optional | Name of the resource | | `email_address` | string | Optional | Parameter for Create After Action Report | | `ticket_details` | string | Optional | Parameter for Create After Action Report | | `oob_recipient` | string | Optional | Parameter for Create After Action Report | | `base64_template` | string | Optional | Base64 encoded template | | `custom_fields` | string | Optional | Custom fields to be added to the report. The template must have the exact key name. It needs to be a json string where the key is the field name and the value is the value to be added to that field. | ### Input Example `{"event_source":"string","tracking_id":"string","case_summary":"string","soc_analysis":"string","event_occurred_on":"string","event_received_on":"string","case_created_on":"string","case_claimed_on":"string","case_closed_on":"string","case_tt_closed_min":"string","case_current_owner":"string","analyst_phone":"string","user_account":"string","hostname":"Example Name","email_address":"string","ticket_details":"string","oob_recipient":"string","base64_template":"string","custom_fields":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------- | | `report` | object | Output field: report | ### Output Example `{"report":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |