Investigation Report Generation

What problem does it solve?

This Skill turns completed DFIR analysis outputs and a finalized Common Operating Picture into a structured written investigation report without guessing or inventing facts.

Core Features & Use Cases

• Evidence-grounded report drafting: Produces timelines, scope reconstruction, and findings only from workflow output files.
• Operational integrity and auditability: Enforces UTC timestamps, chain-of-custody hashes, and citation requirements for every claim.
• Modular section coverage by case type: Conditionally includes sections such as web server triage, C2, credential access, persistence, anti-forensics, ransomware indicators, IOCs, memory/cloud/macOS analysis, and recommendations based on what evidence exists.

Quick Start

Use the investigation-report skill at case closure after the Investigation Section Chief has finalized the COP and completed analysis workflow outputs for the case directory.