Write the report from notes you took at the time

short · 50 min · Objective 4.2

Task

Produce a full incident report from your staged intrusion, then audit it for the two failures that matter: claims stronger than the evidence, and anything in it that should never have been written down.

Steps

  1. Write the report in the standard structure: executive summary, timeline, scope and impact, root cause, response actions, what worked and what did not, findings with owners, appendices.
  2. Write the executive summary so that reading only it leaves the reader correctly informed. Half a page, no jargon.
  3. Now audit it. Go through every sentence and mark it: fact (with a source), inference (with a confidence), or neither. Rewrite every sentence marked neither.
  4. Find every negative claim -- "no data was taken", "the attacker had no access to X" -- and either attach the evidence that proves the negative or rewrite it as "no evidence of".
  5. State your visibility limits explicitly: retention, coverage, what you could not examine.
  6. Audit for what must not be there: speculation as finding, attribution beyond the evidence, blame directed at a person, unnecessary personal data, and any credential, key or token.
  7. Finally, compare your report against your contemporaneous notes and count the claims in the report that the notes do not support.

Verify

grep -ciE "no evidence of|we cannot (confirm|determine)|unable to establish" /tmp/incident-report.md
grep -ciE "^(no|the attacker did not|there was no) [a-z]+ (was|were) (taken|accessed|affected)" /tmp/incident-report.md
grep -ciE "password|secret|api[_-]?key|token|BEGIN (RSA|OPENSSH|PRIVATE)" /tmp/incident-report.md
grep -ciE "sophisticated|nation-state|unprecedented|advanced persistent" /tmp/incident-report.md
wc -w < /tmp/incident-report.md

The first must be non-zero: a report with no honest statement of uncertainty has overstated something. The second must be zero -- unqualified negative claims are the sentences that become retractions. The third must be zero, without exception: a report quoting a credential to prove it was exposed has exposed it again, to a wider audience, in a document that will be emailed and archived. The fourth should be zero too; those words are almost always doing work the facts are not.

Notes

The count from step 7 is the reason contemporaneous notes matter. Claims that appear in the report and not in the notes were reconstructed, and reconstruction after you know the outcome is where hindsight quietly makes the early decisions more coherent than they were.

Write the report as though it will be read by the regulator, the customer's lawyer, the journalist and the colleague whose control failed -- because over a long enough period, it will be.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.