If you want end users to be able to add an attachment to their incident, then the OOTB solution is to ask them to save and then use the add attachment action. But that isn't too popular, so what you could also do is create a new attachment object on your incident (or better multi-attachment so they can add several), put that on the window and they can use that to add their attachment while logging the issue. It means analysts may have to look in two spots for attachments though.
In theory it would be possible to copy a single initial attachment to the attachment collection as it was saved. However this will double up on your storage and in the past I've found this to be slightly unreliable and varies between versions of the product. But things will probably have improved since I last looked at it. I was sure someone had spelled out a way this might work using copy rules, but I'm blowed if I can find it now. However this discussion is worth taking a look through.