Incident briefs

Briefs translate an investigation into language for a specific audience — typically executive leadership or the IR retainer.

Brief sections

• Executive summary (plain English, no jargon)
• Technical details (attack chain, indicators, affected assets)
• Response steps (what was done, what is pending)
• Compliance notes (controls touched and evidence references)

Generation

Briefs draw from the investigation's timeline, evidence, approvals and linked alerts. The model never invents detail — if a section has no source data the brief notes "no evidence available for this section".

Distribution

Briefs can be exported as markdown or PDF, copied to clipboard, or shared via internal link. Every export writes to the audit log.