case-report

Provide the SOAR case ID and the skill retrieves full case details, alerts, and comments using get_case_full_details, synthesizes the findings, and writes a structured Markdown report to a file. It can optionally post a comment back to the case with the report location.

The report follows a standard template with an executive summary, timeline of key events, involved entities and enrichment data, analysis or root cause, actions taken, and recommendations or lessons learned. It also embeds a Mermaid sequence diagram of the investigation workflow.

Yes, the skill generates a Mermaid sequence diagram summarizing which tools were used and in what order during the investigation. This diagram is embedded directly into the final Markdown report.

No, it only reports on existing or recently concluded investigations. It explicitly excludes new investigation steps, deep forensic analysis, malware reverse engineering, and containment or remediation actions.

The only required input is the SOAR case ID. Optional inputs include a report filename suffix and additional context or pre-synthesized findings the analyst wants included in the report.