Reports

Two kinds of report

DFIRe supports two types of reports to serve different documentation needs:

The CAN report

A situational awareness report designed for quick status updates and shift handovers. The CAN format provides a structured way to communicate:

• Conditions: Current situation and context of the investigation
• Actions: Ongoing response activities and work in progress
• Needs: Outstanding requirements, blockers, and resource needs

Each update writes a new version and keeps the previous ones, so the record shows how the situation moved. Update it at a shift change or when something significant happens.

The investigation report

The main deliverable for a finished investigation, built from sections. It offers:

• Configurable section structure
• Rich text editing with Markdown support
• Dynamic content with evidence and image references
• Auto-generated sections (timeline, evidence inventory)
• QA review workflow
• PDF export, from the interface or the API

Sections

An investigation report consists of sections.

Editable and generated

Sections fall into two categories:

• Editable sections: User-written content with Markdown support
• Generated sections: Auto-populated content from case data

What DFIRe generates

These sections are automatically populated based on case data:

• Title Page: Case details, dates, and team members
• Table of Contents: Auto-generated navigation
• Timeline: The case's visible timeline entries, each in the style it has on the timeline. An action's note prints under the action's latest Action started or Action completed entry. The entries that record each edit of a note stay out. See The timeline in reports.
• Indicators of Compromise: All IOCs associated with the case, including values, types, classifications, public notes, and case-specific context notes
• Evidence Inventory: Complete list of evidence items
• Detailed Item Reports: Each evidence item's details, notes, files and images, its chain of custody, and who holds it now. Images pasted into a note print in the note. A Direct Storage file's hash carries a note when DFIRe has not confirmed it against the file on storage. The note says why, for example that the uploader's browser declared the hash. A Direct Storage file without a hash reads Not calculated, or Calculation in progress while DFIRe calculates it. For the full custody record with each entry's hash, print the item's custody receipt.
• Appendices: Case notes marked as appendices, one lettered section each

Appendices

You can include a case note in the report as an appendix. On the Notes tab, switch on Include as appendix. The note prints after the last section as Appendix A, Appendix B and so on, in the order you wrote the notes. The table of contents lists each appendix. The first line of the note is its title. Images pasted into the note print in the appendix. Letters keep appendices apart from numbered sections, so nobody mistakes Appendix B for section 2.

A note goes on the timeline or into the report, not both. A short entry about what happened belongs on the timeline. A longer technical write-up, a list or source code belongs in an appendix. You can turn either switch off again. Appendices stay editable after you finalize the report. The report editor lists them and links to each note. On the Report tab of the case, the Appendices row of the sections table shows how many notes are marked, when there are any.

Leaving a section out

A section template names where it appears:

• Incident cases only
• Investigation cases only
• Both incident and investigation cases

You can also drop a single section from one case's final report without deleting what it holds.

Writing

The editor

The report editor supports Markdown formatting:

• Bold, Italic, and other text formatting
• Headings (H1-H4)
• Bullet and numbered lists
• Block quotes
• Code blocks
• Tables
• Links

Saving

Changes are automatically saved as you type. After you stop typing, your changes are saved within one second. A save indicator shows when changes are being saved and when the save is complete.

Two people editing at once

DFIRe prevents conflicting edits when multiple users work on the same report:

• When you open a section for editing, it's locked to other users
• Other users see who is currently editing
• Locks are released automatically when you stop typing
• A 15-minute failsafe releases a lock if something goes wrong

Drafting with AI

When an LLM provider is configured, DFIRe can generate draft content for reports using AI. Generated content lands in the editor for you to review and edit. Nothing is finalized automatically.

A CAN report

On the CAN Report tab, click Generate with AI to produce a new CAN report version. DFIRe sends a snapshot of the case data to the configured LLM, which returns structured content for the Conditions, Actions, and Needs sections.

• You can provide additional instructions per generation (e.g., "Focus on the network intrusion aspects" or "Keep it concise for executive stakeholders")
• The generated report is saved as a new version, preserving existing versions
• Content can be edited after generation like any other CAN report

A report section

Editable report sections that have AI generation enabled show a generate button in the section editor. Clicking it sends the case data along with the section's AI prompt to the LLM, which returns Markdown content.

• The LLM receives the content of other report sections, allowing it to avoid repetition and maintain consistency across the report
• Each section can have its own tailored AI prompt configured by an administrator
• DFIRe appends the generated text to what the section already holds, then saves the section. Sections keep no version history, so remove anything you do not want to keep

For full details on how the LLM integration works, what data is sent, and how to configure prompts, see AI Integration.

Referring to evidence and files

Insert references to evidence items and images that automatically expand when the report is viewed or exported.

Evidence

Reference evidence items using the syntax:

{{evidence.<uuid>}}

When rendered, this displays the item's name, its type, and a short identifier. Use the reference picker in the editor toolbar to insert references without memorizing UUIDs.

To pull a single detail into a sentence instead of the whole reference, name the field: {{evidence.name.<uuid>}}, and likewise type, owner, user, or flags.

Images

Embed images from evidence attachments:

Reports embed JPEG, PNG, GIF and WebP images. SVG files stay available as file attachments.

{{image.<size>.<id>}}

Files shows the id of each image after its file size. An image you open shows its id under it.

Available sizes:

• small - Thumbnail size
• medium - Half-width image
• large - Full-width image
• description - Inserts the image's description as text instead of the image

Attachments

Link to file attachments:

{{attachment.<id>}}

Files shows the id of each file after its size.

A single detail can be pulled out the same way: {{attachment.hash.<id>}}, and likewise filename, description, or size. Quoting an acquisition hash inline this way keeps it correct if the attachment is replaced.

When DFIRe has not confirmed a Direct Storage file's hash, both forms add a short note after it. Two examples are declared by the uploader's browser, not verified by DFIRe and does not match the file on storage. The editor preview and the PDF print the same note. See Storage: Hashes and what they prove.

Review before delivery

Each section moves through review on its own, so one author can keep writing while another is checked.

Section states

State	Description	Actions Available
Draft	Section is being written or revised	Edit content, submit for QA
Ready for QA	Author has submitted for review	Review, approve, or return to draft
QA Completed	Section has been reviewed and approved	Return to draft for revisions

Versions

Reports use a version number to track progress:

• 0.x (Draft): Report is work in progress. Minor version increments when sections are submitted for QA.
• 1.x (Finalized): Report has been finalized and is ready for delivery. Subsequent revisions increment the minor version.

How a review runs

1. Author writes section content
2. Author clicks "Ready for QA" to submit for review
3. Reviewer examines the section content
4. Reviewer either approves (QA Complete) or returns to draft with feedback
5. Once all sections are approved, the report can be finalized

Finalizing also fires the Report Finalized notifier event, which carries the case, the version and a link to the report. See Webhooks and Email.

Which sections exist

Section templates are configured once for the installation under Settings → Reporting, not per case or per playbook. An administrator decides the order, which sections are editable and which are generated, whether a section appears in incident reports, investigation reports or both, and which ones start excluded. See Configuration.

A report already under way keeps its sections. Changing the Default content or Internal setting of a template affects only sections created afterwards. The title, order and writing guide of a section always follow its template. A template you add later, or later include in incident or investigation reports, adds its section to existing reports of that kind. Clearing a checkbox under Include in does not remove the section from reports that already have it.

Exporting as PDF

DFIRe renders the report as a PDF on the server. On the case's Report tab, select Export PDF. The PDF opens in a new browser tab, where you can save or print it. To download the reports of many cases, filter the cases on the Analytics page and select Export all reports (see Analytics: The case list).

The PDF follows the section templates: their order, their page breaks, and which sections you excluded. It has a title page, a table of contents with page numbers, and bookmarks for every section. The footer on each page shows the case number and the page number. A short timeline entry never splits across pages, and the footer says when the timeline continues on the next page. DFIRe expands evidence references and embeds the images placed with {{image...}}. TLP:RED indicators are left out of the indicators section, and so are timeline entries that name one, such as Indicator added. Text that people write, such as notes and report sections, prints as written.

Dates and times follow the clock in the header: UTC, or your local time. The title page names the time zone.

DFIRe does not embed images on Direct Storage, images larger than 25 MB, or images beyond the first 200 MB in one report. The PDF shows their caption only.

Exporting with the API

GET /api/cases/{id}/export/report/ returns the same PDF. Authenticate with an API key (see API Access). Add ?tz= and an IANA time zone name, such as ?tz=Europe/Helsinki, for local times. Without it, times are in UTC.

To export the reports of many cases, list the cases with GET /api/cases/ and request each report in turn. If the server is busy with other reports, it answers 503. Wait a few seconds and send the request again.

An export needs the permissions to view and export the case. It also needs read access to every part of the report. These are the report and its section templates, evidence items with their notes and custody records, attachments, timeline entries, and the case's indicators. Each export writes one entry to the audit log, which lists the images embedded in the PDF.