Incident export lacks Discovery incidents This is expected behavior. Incident export exports only data loss prevention and endpoint incidents.