/generate-report

type: Skill
name: generate-report
description: "Save investigation findings to a markdown report file. Use after completing triage, enrichment, or investigation to create a permanent record. Generates timestamped files in ./reports/ directory."
personas: [all]
generated:
  by: human:mlutx
  at: 2026-01-12T17:23:43-06:00

Generate Report Skill

Save generated report content to a markdown file with standardized naming convention.

Inputs

• `REPORT_CONTENT` - The full markdown content of the report
• `REPORT_TYPE` - Short identifier for the report type:
• `alert_triage` - Alert triage reports
• `ioc_enrichment` - IOC enrichment reports
• `case_investigation` - Case investigation reports
• `hunt_summary` - Threat hunt reports
• `incident_report` - Incident response reports
• `REPORT_NAME_SUFFIX` - Descriptive suffix (e.g., case ID, IOC value, hunt name)
• *(Optional)* `TARGET_DIRECTORY` - Directory to save in (default: `./reports/`)

Workflow

Step 1: Construct Filename

Generate standardized filename:

{TARGET_DIRECTORY}/{REPORT_TYPE}_{REPORT_NAME_SUFFIX}_{YYYYMMDD_HHMM}.md

Examples:

• `./reports/alert_triage_case_1234_20250115_1430.md`
• `./reports/ioc_enrichment_198.51.100.10_20250115_0900.md`
• `./reports/hunt_summary_APT29_20250115_1200.md`

Step 2: Write File

Use the Write tool to save `REPORT_CONTENT` to the constructed path.

Outputs

| Output | Description | |--------|-------------| | `REPORT_FILE_PATH` | Full path to the saved report file | | `WRITE_STATUS` | Success/failure status of the write operation |

Report Template Structure

# [Report Type]: [Subject]

**Generated:** [timestamp]
**Runbook:** [runbook name that generated this]
**Case/Alert ID:** [if applicable]

## Summary
[Brief overview of findings]

## Details
[Detailed findings, enrichment data, etc.]

## Assessment
[Risk assessment, classification]

## Recommendations
[Next steps, actions to take]

## Appendix
[Raw data, tool outputs, diagrams]

Naming Convention

| Report Type | Suffix Example | Full Example | |-------------|----------------|--------------| | alert_triage | case_1234 | `alert_triage_case_1234_20250115_1430.md` | | ioc_enrichment | evil.com | `ioc_enrichment_evil.com_20250115_0900.md` | | hunt_summary | APT29 | `hunt_summary_APT29_20250115_1200.md` |