report-writing-guidelines

Structures and formats cybersecurity incident reports from investigation findings.

85|14|Updated May 17, 2025
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill report-writing-guidelines-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: report-writing-guidelines
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/reporting/report-writing-guidelines
Command: npx skills add https://github.com/dandye/adk_runbooks --skill report-writing-guidelines-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security investigations produce scattered findings, case data, and workflow diagrams that must be consolidated into consistent, professional reports. This Skill provides a standard structure and template so incident reports, threat hunt summaries, and triage reports follow the same format every time. ## Core Features & Use Cases - Standardized Report Structure: Organizes findings into metadata, executive summary, detailed findings, analysis, conclusions, and recommendations. - Metadata Embedding: Automatically includes runbook name, generation timestamp, SOAR case IDs, and a Mermaid sequence diagram of the agent workflow. - Consistent Naming & Saving: Saves reports via the write_report tool using a standardized filename pattern combining report type, case ID, and timestamp. - Use Case: After investigating SOAR case 2396, an analyst uses this Skill to compile the findings, embed the agent workflow diagram, and save a formatted Markdown report linked to the case. ## Quick Start Write a report on the findings from SOAR case 2396 including a Mermaid diagram of which agents called which MCP tools.

Frequently Asked Questions about report-writing-guidelines

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a cybersecurity incident report from investigation findings?▼

Gather your findings, case ID, and workflow diagram, then structure the report with metadata, executive summary, detailed findings, analysis, conclusions, and recommendations. Save the result with the write_report tool using a filename combining report type, case ID, and timestamp.

What sections should a security incident report include?▼

A security incident report should include metadata (runbook name, timestamp, case IDs), an executive summary, detailed findings, analysis, conclusions, and recommendations. It should also embed a Mermaid sequence diagram showing which agents called which MCP tools.

How do I include a Mermaid diagram in an incident report?▼

Generate a Mermaid sequence diagram illustrating the agent and tool workflow performed during the investigation, then embed it in the report's metadata section. The diagram documents which agents called which MCP tools during execution.

What is the naming convention for saved security reports?▼

Reports are saved using the pattern <report_type>_<report_name_suffix>_<CASE_ID>_<timestamp>.md via the write_report tool. All variables such as case ID and timestamp must be resolved before the save call.

When should I use report templates instead of these general guidelines?▼

Use the specific templates in rules-bank/reporting_templates.md when the report type has defined section requirements, such as triage or threat hunt reports. The general guidelines apply when no type-specific template exists.