Cline rules

1# Reporting Templates & Guidelines
2 
3This file outlines standard formats and required elements for common reports generated during security operations.
4 
5## General Report Metadata Requirements
6 
7*   **Runbook Reference:** All reports generated via runbook execution **must** clearly state which runbook was used at the beginning of the report.
8    *   *Example:* `**Runbook Used:** Alert Investigation Summary Report Runbook`
9*   **Timestamp:** Include a generation timestamp in a consistent format (e.g., YYYY-MM-DD HH:MM Timezone).
10*   **Case ID:** Reference the relevant SOAR Case ID(s).
11*   **Workflow Diagram:** Include a Mermaid sequence diagram from the executed runbook, showing the actual MCP Servers and Tools used.
12 
13## Common Report Types (Placeholders - To be defined)
14 
15### Daily SOC Summary
16 
17*   *(Define required sections, e.g., Key Metrics, Notable Alerts, Ongoing Incidents, Shift Handover Notes)*
18 
19### Post-Incident Report
20 
21*   *(Define required sections, e.g., Executive Summary, Incident Timeline, Root Cause Analysis, Impact Assessment, Actions Taken, Lessons Learned, Recommendations)*
22 
23### Threat Hunt Summary Report
24 
25*   *(Define required sections, e.g., Hunt Hypothesis, Scope, Timeframe, Queries Used, Findings (Positive/Negative), Enrichment Details, Recommendations/Escalation)*
26 
27### Vulnerability Triage Report
28 
29*   *(Define required sections, e.g., Vulnerability Details (CVE), Affected Assets, GTI/SIEM Context, Remediation Steps, Prioritization)*
30 
31*(Add other relevant report templates as needed)*
32