Skip to content

Reports

Findings people outside security can read.

An investigation is only useful if the people who need it can read it. armor360 writes reports for the people who receive them, from the board to the auditor.

Start a free pilotSee pricing
From the work to the reportInvestigationsCoverageDetection rulesMonthly security reportAlerts looked into, by weekW1W2W3W494%of machines sending logsNeeds your decisionApprove two quieter rule versionsFix logging on three machinesReview one access exceptionReady to send
Illustrated example with made-up figures: every line of a report traces back to the investigations behind it.

Writing it up takes as long as finding it.

Every serious finding ends in a write-up, and every audience needs a different one.

  • Hours of writing

    Turning searches and notes into a clear account is slow, careful work.

  • The wrong level

    What an analyst needs and what a manager needs are different documents.

  • Claims without sources

    A report that cannot point to its evidence does not survive an audit.

  • Coverage by spreadsheet

    Showing which attacks your rules cover is usually a manual exercise.

From investigation to report.

The same evidence, written for the person who receives it, in the format they need.

An investigation, written up for the readerFrom our lab
Incident report: linux04HTMLWordPDF
What happened

An adversary-simulation agent, caldera-agent, was running on linux04 and beaconing every five minutes over HTTP. E6

What it touched

linux04, which serves customer onboarding and end-of-day settlement. Owner: operations team. E1

How sure

Real attack, 90% confidence. The reviewer’s decision is recorded beside it. E9

Recommended next steps

Check other machines for the same process. Keep the logs from linux04.

Built from the lab investigation. Each claim keeps its evidence number, so a reader can go from a sentence to the record behind it.

Written for the reader

Each investigation can be shared as a report in HTML, Word or PDF: what happened, what it touched, how sure the agent is and what it recommends, in plain words.

  • HTML, Word or PDF
  • What happened, in plain words
  • What it touched and what is at risk
  • Recommended next steps

Every claim traceable

Reports keep the evidence numbers, so a reader can go from a sentence to the record behind it. Who reviewed the verdict, and when, is part of the record.

ATT&CK coverage, ready in minutes

A report of which MITRE ATT&CK techniques your live rules cover and where the gaps are, built from the rules you actually run.

For providers and their customers

Managed security providers can share reports with each customer, built only from that customer’s data.

How a report is made.

  1. 1

    An investigation finishes

    The agent reaches a verdict with its confidence, a plain account of what happened, what it touched and the recommended next steps, with each claim cited.

  2. 2

    A person reviews it

    Someone on your team agrees with the verdict or changes it. Who reviewed it, and when, becomes part of the record the report is built from.

  3. 3

    Choose the format

    Share the investigation as HTML to read in a browser, as Word to edit before sending, or as PDF to file with your records.

  4. 4

    The reader follows it

    The report keeps the evidence numbers in the text, so a manager, customer or auditor can go from any sentence to the record behind it.

Reports that hold up.

  • Three formats

    HTML to read, Word to edit, PDF to file.

  • Plain summary

    What happened, in words a manager can read.

  • Cited evidence

    Each claim points to its record.

  • Review on record

    Who agreed with or changed the verdict, and when.

  • ATT&CK coverage

    Techniques covered and gaps, from your live rules.

  • Share per customer

    Each customer sees only their own reports.

A write-up, by hand and with armor360.

TopicBy hand todayWith armor360
Writing timeAn analyst turns searches and notes into prose after the technical work is done, often late and under pressure. The report is written from the investigation itself, so the account is ready as soon as the verdict is.
The audienceOne write-up has to serve both technical readers and managers, and usually suits neither of them well. Reports are written for the people who receive them, in plain words, with the evidence there for technical readers.
SourcesClaims in a report often point nowhere, so a reviewer has to ask the analyst where each one came from. Each claim keeps its evidence number, so a reader can open the record behind it.
Review historyWho checked the conclusion, and when, sits in email threads kept apart from the report. Who agreed with or changed the verdict, and when, is part of the record the report carries.
ATT&CK coverageShowing which techniques your rules cover means building a spreadsheet by hand for each audit or board paper. An ATT&CK coverage report is built from your live rules, showing techniques covered and where the gaps are.

Frequently asked questions

Who are the reports for?

Anyone who needs to know what happened without reading raw logs: managers, other teams, customers of a managed provider, and auditors. The report says what happened, what it touched, how sure the agent is and what it recommends.

Can we edit a report before sending it?

Yes. The Word version is there for that. The evidence numbers stay in the text so edits do not lose the link to the records behind each claim.

Read next

More of the platform

See where your team’s time goes. Then decide.

Start a free pilot on your own alerts, or put in your own numbers first.

Start a free pilotRun your numbers