Description
Synthesize all analysis outputs into structured intelligence reports tailored to different audiences: technical reports for SOC teams, executive summaries for leadership, and structured data for threat intelligence platforms.
Rationale
Intelligence is only valuable if it reaches the people who can act on it, in a format they can consume. A SOC analyst needs technical details and detection rule recommendations. An executive needs a risk assessment and resource implications. A threat intelligence platform needs structured, machine-readable data. Effective reporting produces all three from the same underlying analysis.
Supporting Basis
Author-derived extensionThe sources motivate post-operation analysis and reporting; this technique is an author-defined reporting step.
- Almeshekah, M.H.; Spafford, E.H. Planning and Integrating Deception into Computer Security Defenses. NSPW 2014.Peer reviewed
- The MITRE Corporation. A Practical Guide to Adversary Engagement, version 1.0. 2022.Technical guide
These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.
Implementation Steps
Aggregate analysis outputs
Collect all analysis products: TTP catalogs, ATT&CK mappings, IOC lists, attack path reconstructions, and capability assessments.
Produce technical report
Create a detailed technical report for SOC and IR teams that includes specific findings, detection recommendations, and containment guidance.
Generate executive summary
Create an executive summary that translates technical findings into business risk language, including recommended actions and resource implications.
Export structured intelligence
Export findings in machine-readable formats (STIX/TAXII, OpenIOC) for integration with threat intelligence platforms and automated defense systems.
Technical Implementation Examples(1)
Intelligence Report Template (Markdown)
Structured template for producing technical intelligence reports from deception engagements
# Deception Intelligence Report
## Engagement ID: SHD-2026-0042
**Classification:** INTERNAL - TLP:AMBER
**Report Date:** 2026-03-28
**Analyst:** SOC Team
**Status:** Final
---
## Executive Summary
Between 2026-03-20 and 2026-03-21, an adversary interacted with
ShadowMatrix CDF deception assets deployed in the production network.
The adversary demonstrated [THREAT_LEVEL] capability, using
[CUSTOM/PUBLIC] tooling to enumerate [N] deception hosts and
attempt credential harvesting.
**Key Findings:**
- Adversary accessed [N] deception assets over [N] hours
- [N] novel TTPs identified not covered by existing detection rules
- [N] IOCs extracted and validated for distribution
- Assessed threat level: [APT/ORGANIZED/OPPORTUNISTIC]
## Adversary Activity Timeline
| Time (UTC) | Action | Target | Details |
|-------------|--------|--------|---------|
| 03-20 14:22 | SSH Login | prod-app-srv-07 | Used trap creds: j.martinez |
| 03-20 14:25 | Enumeration | prod-app-srv-07 | whoami, id, cat /etc/passwd |
| 03-20 14:31 | Config Access | prod-app-srv-07 | Read /opt/app/config/database.yml |
| 03-20 14:35 | Lateral Move | prod-db-04 | SSH using harvested DB credentials |
| 03-20 14:40 | DB Access | prod-db-04 | psql connection to customerdb |
## TTPs Observed (MITRE ATT&CK)
| Technique ID | Name | Procedure | Detection Gap? |
|-------------|------|-----------|----------------|
| T1078 | Valid Accounts | Used planted credentials | No |
| T1033 | User Discovery | whoami, id commands | No |
| T1087.001 | Local Account | cat /etc/passwd | No |
| T1005 | Data from Local System | Read config files | YES - new rule needed |
## Indicators of Compromise
| Type | Value | Confidence | Context |
|------|-------|------------|---------|
| IPv4 | 198.51.100.42 | High | Source IP of adversary SSH sessions |
| SHA256 | a1b2c3... | High | Tool uploaded to honeypot |
## Recommendations
1. **IMMEDIATE:** Deploy Sigma rule for T1005 config file access
2. **SHORT-TERM:** Rotate credentials matching patterns used by adversary
3. **MEDIUM-TERM:** Extend deception coverage to workstation subnet
4. **LONG-TERM:** Refresh all deception assets interacted with
## Deception Effectiveness Assessment
- **Assets that attracted interaction:** 2 of 8 (25%)
- **Breadcrumbs followed:** credential trail from app config (effective)
- **Assets ignored:** admin-portal, fileserver-finance
- **Recommendation:** Increase visibility of ignored assets via DNSConsiderations
- Tailor language and detail level to each audience. Technical jargon in an executive summary reduces its impact.
- Include actionable recommendations in every report. Findings without recommended actions are informational, not intelligence.
- Establish a regular reporting cadence even when there is minimal deception activity. Absence of activity is itself an intelligence finding.
Supported Environments
Tools & Resources
- Report templates
- STIX/TAXII tools
- Threat intelligence platforms
- Visualization tools
Related Techniques
Quick Stats
- Phase
- Analyze
- Difficulty
- intermediate
- Detection Value
- medium
- Cost
- minimal
- Time
- 2-5 days per engagement
- ATT&CK Mappings
- 0