Incident Report Builder | SancLogic

Core Report (Required)

Executive Summary Required

2-3 sentences for leadership

Who Required

Threat Actor IPs

Compromised Accounts

What Required

Attacker Actions (one per line)

When Required

Date Range

Key Timestamps

Where Required

Target Systems

Malware/Tool Paths

Why Required

Root Cause

Attacker Objective

How Required

Attack Methodology

Recommendations Required

Immediate (0-24 hours)

Short-term (1-7 days)

Long-term (30-90 days)

Optional

Impact Optional

Potential Damage

Actual Impact

Appendix (T2 Full Report)

Detailed Timeline Appendix

Full chronological timeline

Indicators of Compromise Appendix

File Hashes

Domains

IPs

File Paths

MITRE ATT&CK Mapping Appendix

Techniques (Tactic | Technique | ID)

OSINT Appendix

VirusTotal Findings

Detection Queries Appendix

SPL / KQL Queries

Evidence Screenshots Appendix

Evidence 1