Investigation Report Generation

To generate a DFIR investigation report without hallucinating facts, use a Skill that consumes completed triage outputs and a finalized Common Operating Picture from a SIFTics case directory, requiring source-cited claims from CSV, txt, and log files for every assertion made.

An evidence-backed incident response report includes UTC timelines, scope-of-compromise reconstruction, ATT&CK-aligned findings, and IOC sections, conditionally covering web server triage, C2, credential access, persistence, anti-forensics, and memory or cloud analysis based on existing evidence.

To handle UTC timestamps and chain of custody in digital forensics documentation, the reporting process enforces strict UTC timestamp handling and validates chain-of-custody hashes while writing final deliverables only under the ./reports/ directory.

Yes, you can build ATT&CK-aligned findings from macOS and cloud environments. The report generation process conditionally includes memory, cloud, and macOS analysis sections based on the specific evidence present in the completed workflow output files.

Yes, the investigation report generation process applies prompt-injection sanitization techniques specifically for attacker-controlled CSVs, ensuring that malicious inputs within triage outputs cannot manipulate the evidence-backed report drafting logic.

You should not use an automated investigation report generator when your DFIR case directory lacks completed analysis workflow outputs or a finalized Common Operating Picture, as the process strictly prohibits inventing facts and requires source-cited evidence files.