Report generator
Prepare a security incident report with the structure used by incident response teams, then print it or export it to PDF or JSON. It is an exercise in professional writing: for students, junior SOC analysts and exam candidates; beginner level, about 20 minutes.
The report follows this template:
- Summary: what happened, severity and current status, in a few lines for decision-makers.
- Scope and authorisation: the systems analysed, who authorised the work and within which limits.
- Timeline: events in chronological order, with date, time and time zone.
- Evidence and indicators of compromise (IoCs): logs, hashes, addresses, domains, with the source of each item.
- Impact: technical, data and business effects.
- Recommendations: corrective and preventive actions, one per line, with priority.
Report details
Do not enter real personal data or confidential information. Use fictitious or anonymised names, addresses and data: the PDF is generated on EVIL's server and the text travels over the network. For a real incident use the tools and channels approved by your organisation. See Privacy and terms and Ethics and law.
1. Summary
2. Scope and authorisation
Every analysis must have written authorisation: state here who gave it and within which limits.
3. Timeline
4. Evidence and IoCs
For examples use the domains reserved for documentation (example.com) and the documentation IP ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24).