Reports

Two kinds of report

DFIRe supports two types of reports to serve different documentation needs:

The CAN report

A situational awareness report designed for quick status updates and shift handovers. The CAN format provides a structured way to communicate:

• Conditions: Current situation and context of the investigation
• Actions: Ongoing response activities and work in progress
• Needs: Outstanding requirements, blockers, and resource needs

Each update writes a new version and keeps the previous ones, so the record shows how the situation moved. Update it at a shift change or when something significant happens.

The investigation report

The main deliverable for a finished investigation, built from sections. It offers:

• Configurable section structure
• Rich text editing with Markdown support
• Dynamic content with evidence and image references
• Auto-generated sections (timeline, evidence inventory)
• QA review workflow
• Print-optimized output

Sections

An investigation report consists of sections.

Editable and generated

Sections fall into two categories:

• Editable sections: User-written content with Markdown support
• Generated sections: Auto-populated content from case data

What DFIRe generates

These sections are automatically populated based on case data:

• Title Page: Case details, dates, and team members
• Table of Contents: Auto-generated navigation
• Timeline: All timeline entries from the case
• Indicators of Compromise: All IOCs associated with the case, including values, types, classifications, public notes, and case-specific context notes
• Evidence Inventory: Complete list of evidence items
• Detailed Item Reports: Expanded evidence item details
• Appendices: Case notes marked as appendices, one lettered section each

Appendices

You can include a case note in the report as an appendix. On the Notes tab, switch on Include as appendix. The note prints after the last section as Appendix A, Appendix B and so on, in the order you wrote the notes. The table of contents lists each appendix. The first line of the note is its title. Letters keep appendices apart from numbered sections, so nobody mistakes Appendix B for section 2.

A note goes on the timeline or into the report, not both. A short entry about what happened belongs on the timeline. A longer technical write-up, a list or source code belongs in an appendix. You can turn either switch off again. Appendices stay editable after you finalize the report. The report editor lists them and links to each note. On the Report tab of the case, the Appendices row of the sections table shows how many notes are marked, when there are any.

Leaving a section out

A section template names where it appears:

• Incident cases only
• Investigation cases only
• Both incident and investigation cases

You can also drop a single section from one case's final report without deleting what it holds.

Writing

The editor

The report editor supports Markdown formatting:

• Bold, Italic, and other text formatting
• Headings (H1-H4)
• Bullet and numbered lists
• Block quotes
• Code blocks
• Tables
• Links

Saving

Changes are automatically saved as you type. After you stop typing, your changes are saved within one second. A save indicator shows when changes are being saved and when the save is complete.

Two people editing at once

DFIRe prevents conflicting edits when multiple users work on the same report:

• When you open a section for editing, it's locked to other users
• Other users see who is currently editing
• Locks are released automatically when you stop typing
• A 15-minute failsafe releases a lock if something goes wrong

Drafting with AI

When an LLM provider is configured, DFIRe can generate draft content for reports using AI. Generated content lands in the editor for you to review and edit. Nothing is finalized automatically.

A CAN report

On the CAN Report tab, click Generate with AI to produce a new CAN report version. DFIRe sends a snapshot of the case data to the configured LLM, which returns structured content for the Conditions, Actions, and Needs sections.

• You can provide additional instructions per generation (e.g., "Focus on the network intrusion aspects" or "Keep it concise for executive stakeholders")
• The generated report is saved as a new version, preserving existing versions
• Content can be edited after generation like any other CAN report

A report section

Editable report sections that have AI generation enabled show a generate button in the section editor. Clicking it sends the case data along with the section's AI prompt to the LLM, which returns Markdown content.

• The LLM receives the content of other report sections, allowing it to avoid repetition and maintain consistency across the report
• Each section can have its own tailored AI prompt configured by an administrator
• DFIRe appends the generated text to what the section already holds, then saves the section. Sections keep no version history, so remove anything you do not want to keep

For full details on how the LLM integration works, what data is sent, and how to configure prompts, see AI Integration.

Referring to evidence and files

Insert references to evidence items and images that automatically expand when the report is viewed or exported.

Evidence

Reference evidence items using the syntax:

{{evidence.<uuid>}}

When rendered, this displays the item's name, its type, and a short identifier. Use the reference picker in the editor toolbar to insert references without memorizing UUIDs.

To pull a single detail into a sentence instead of the whole reference, name the field: {{evidence.name.<uuid>}}, and likewise type, owner, user, or flags.

Images

Embed images from evidence attachments:

{{image.<size>.<id>}}

Available sizes:

• small - Thumbnail size
• medium - Half-width image
• large - Full-width image
• description - Inserts the image's description as text instead of the image

Attachments

Link to file attachments:

{{attachment.<id>}}

A single detail can be pulled out the same way: {{attachment.hash.<id>}}, and likewise filename, description, or size. Quoting an acquisition hash inline this way keeps it correct if the attachment is replaced.

Review before delivery

Each section moves through review on its own, so one author can keep writing while another is checked.

Section states

State	Description	Actions Available
Draft	Section is being written or revised	Edit content, submit for QA
Ready for QA	Author has submitted for review	Review, approve, or return to draft
QA Completed	Section has been reviewed and approved	Return to draft for revisions

Versions

Reports use a version number to track progress:

• 0.x (Draft): Report is work in progress. Minor version increments when sections are submitted for QA.
• 1.x (Finalized): Report has been finalized and is ready for delivery. Subsequent revisions increment the minor version.

How a review runs

1. Author writes section content
2. Author clicks "Ready for QA" to submit for review
3. Reviewer examines the section content
4. Reviewer either approves (QA Complete) or returns to draft with feedback
5. Once all sections are approved, the report can be finalized

Finalizing also fires the Report Finalized notifier event, which carries the case, the version and a link to the report. See Webhooks and Email.

Which sections exist

Section templates are configured once for the installation under Settings → Reporting, not per case or per playbook. An administrator decides the order, which sections are editable and which are generated, whether a section appears in incident reports, investigation reports or both, and which ones start excluded. See Configuration.

Template changes reach new cases. A report already under way keeps the sections it was created with.

Printing

Reports are optimized for printing and can be saved as PDF using your browser's print function.

The print layout

• Professional formatting optimized for print
• Table of contents for navigation
• All images and tables included
• Evidence references expanded inline
• Page breaks between sections as configured
• Excluded sections hidden automatically

Saving as PDF

To create a PDF:

1. Open the report in print preview mode
2. Use your browser's print function (Ctrl+P / Cmd+P)
3. Select "Save as PDF" as the destination
4. Adjust page settings if needed and save