# Control 3.4: Incident Reporting and Root Cause Analysis - Screenshot Specifications

## Required Screenshots

| Filename | Portal | Navigation Path | What to Capture |
|----------|--------|-----------------|-----------------|
| `01-sharepoint-incident-list.png` | SharePoint | Incident tracking list | Incident log |
| `02-sharepoint-incident-form.png` | SharePoint | New incident form | Intake form |
| `03-sharepoint-rca-template.png` | SharePoint | RCA template | Root cause analysis form |
| `04-pauto-incident-flow.png` | Power Automate | Incident workflow | Automated routing |
| `05-pauto-escalation.png` | Power Automate | Escalation flow | Escalation rules |
| `06-azure-sentinel-incidents.png` | Azure | Sentinel → Incidents | Security incidents |
| `07-azure-sentinel-investigation.png` | Azure | Sentinel → Investigation | Investigation graph |

## Notes for Verification

- Incident intake process works
- RCA is performed for significant incidents
- Escalation triggers appropriately
- Sentinel integration captures security incidents

---

[Back to Control 3.4](../../controls/pillar-3-reporting/3.4-incident-reporting-and-root-cause-analysis.md)
