Reporting and Communication
Reporting and Communication tests whether you can convert technical findings into a report a client can act on: an executive summary, a defensible timeline, evidence references, and prioritized remediation.
Core rules
- Write for two audiences. The executive summary states impact, scope, and required actions in plain language; the technical section gives evidence, queries, and timestamps.
- Every finding needs support: what you observed, where it came from, and why it matters. Link to log excerpts or file hashes rather than asserting conclusions.
- Build a timeline in UTC and note the source of each timestamp. Separate confirmed events from inferred ones.
- Map activity to MITRE ATT&CK where it aids detection engineering, and give recommendations that are specific and testable. Severity should reflect impact and confidence, not drama.
Worked example
A phishing email led to a macro, PowerShell download, and C2 beacon. The report should state initial access, execution, and command-and-control with timestamps, hostnames, user accounts, file hashes, and domains, then recommend blocking, credential resets, and a hunt for the same macro across mail logs. Reasoning: the reader must be able to reproduce and remediate, not just believe you.
Traps
- Presenting conclusions without evidence or with unexplained gaps.
- Mixing local time and UTC in the timeline.
- Dumping raw logs instead of summarizing and referencing them.
- Omitting containment and credential-reset recommendations.
- Writing an executive summary full of tool names and jargon.