Incident Response Report

Mission

Turn an investigation into a concise report that a human analyst can review and close. Optimize for clarity, evidence traceability, and remediation follow-up.

Writing rules

• Keep the tone direct and professional.
• Separate confirmed facts, indicators, and hypotheses.
• Use UTC timestamps unless the user asks otherwise.
• Cite the telemetry source or log family when possible.
• Do not overstate certainty.
• If evidence is partial, say what is missing and how that limits the conclusion.
• Default to Markdown unless the user requests HTML or another format.
• If public IPs appear in the source material and no enrichment is already present, prefer local enrichment before finalizing the report. If enrichment tooling is unavailable, mark the gap and avoid overclaiming.