The core of all reporting

I had planned to write a one-liner for this post, but I think it deserves more context.The point of reporting is to tell a story, one that flows. This piece of advice during my time at a consultancy sounded easier said than done when I was told it.

The reason someone had to tell me this is because I was writing horrible reports that didn’t flow. What I was missing was the chronological order within the report. Sometimes there were items that I thought were worth writing before other key events had taken place. There is an easy way to write reports however, that guarantees success in this area.

I’m about to talk about this in the next paragraph, because I just remembered another important piece. Don’t write the executive summary until your report is finished. Don’t cheat and begin writing it early, just don’t! You will then be trying to squeeze the full narrative into your executive summary because you’ve already burned the kilojoules by typing it up.

So while you must always write your Executive Summary last, write your timeline first. If you write the timeline first, you will be filling gaps along the way. You can engage in peer review of the timeline yourself before anyone else does. As you go through the timeline you can discover in a very easy to follow format what happened. If you can’t get the timeline straight, then the rest of the report isn’t going to be either.

The timeline is the table of chronological events. One event per line. Reviewing a timeline that spans maybe 2 pages for many P.I.R’s or Cyber Incident Response Investigations is a quick task, and its easy to reference preceeding events. Trying to review a 30 page report and ensure that the chronology flows is not quick, and requires a very long memory. Why put yourself through the hassle?

When writing the report, just print the timeline, or have it on a second screen. Write from top to bottom. Done. This being said, you can’t jump ahead here either, (in the same way you can’t write your executive summary prior to completing the rest of the report). The timeline must be complete, accurate and contain no gaps. If you are asking yourself questions when reviewing the timeline, your reader is going to as well.

To wrap this up tightly:

  1. Build your timeline completely
  2. Write your report by reviewing the timeline, and writing about each timeline entry
  3. Write your Executive Summary.

Good luck writing your next report, you’ll nail it!

One comment

Leave a Reply

Discover more from DFIR Insights

Subscribe now to keep reading and get access to the full archive.

Continue reading