Incident › Module 9 › Lesson 2
IR Reports
IR report literacy — timeline, scope, actions, evidence summary, recommendations — report outline on YOUR `$IR_LAB` tabletop.
Visual · t34_ir_reports
IR reports = named report sections. $IR_LAB. Original Cyberlium.
Opening
Professional IR reports survive audit — name report sections and evidence summary rows on YOUR lab tabletop before sharing prod case data without RoE.
IR report literacy names: executive summary BLUF category, incident timeline UTC category, scope and impact category, actions taken (contain/eradicate/recover literacy), evidence summary category (link Module 4 hygiene), and recommendations category. Analyst drafts IR report outline on `$IR_LAB` tabletop scenario — seven sections with stub content from Modules 5–8 — without copying prod case PII, without fabricating evidence, without omitting limitations paragraph. Cyberlium teaches handoff-quality reporting vocabulary — YOUR notes chmod 600. Refused: prod case exfiltration, fabricated attribution, skip limitations. Lab row: IR report outline seven sections with limitations stub.
1. Named report sections
BLUF, timeline, scope, actions, evidence summary, recommendations, limitations — seven literacy anchors.
Timeline separates observed vs inferred — same discipline as prior modules.
Command guide
Try these commands — Named report sections
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/ SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/post-incident/ir-report-template.md" <<'EOF'
# Incident Response Report — YOUR template
## Executive summary
One paragraph: what happened, impact, resolution status
## Timeline (UTC)
| Time | Event | Actor |
## Scope
Affected systems, data classification, users
## Technical analysis
Initial access, TTPs (descriptive), IOCs (YOUR org only)
## Response actions
Containment, eradication, recovery steps taken
## Comms log
Internal/external notifications with timestamps
## Recommendations
Linked action items from lessons learned
EOFCommand — copy this
grep -E 'Timeline|Response actions|Recommendations' "$IR_LAB/post-incident/ir-report-template.md" curl -sS https://www.first.org/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence summary
Link Module 4 evidence hygiene rows — custody and hash stub cited.
Redact PII in share-safe outline copy on `$IR_LAB`.
3. Refused
No prod case paste without RoE; no fabricated evidence; no skip limitations.
Report literacy supports audit and handoff — not narrative spin.
4. What you ship: IR report outline
Seven sections + limitations paragraph + NEVER prod case exfiltration line.
5. What you record before the next lesson
IR report outline path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Copy employer prod incident ticket with customer PII into lab report as 'realistic outline.'
Right
IR report outline from `$IR_LAB` tabletop stub. Next: Detection Gaps.
Mission: IR report outline
1) Name seven report sections. 2) Stub content from Modules 5–8. 3) Limitations paragraph required. 4) Write NEVER prod case exfiltration line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Limitations paragraph — minimum literacy content?”
Knowledge Check
APPLY: IR report literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Limitations paragraph is optional.
True or False
Knowledge Check
APPLY: IR report sections include:
Multiple choice