Reports

Two kinds of report

DFIRe supports two types of reports to serve different documentation needs:

The CAN report

A situational awareness report designed for quick status updates and shift handovers. The CAN format provides a structured way to communicate:

• Conditions: Current situation and context of the investigation
• Actions: Ongoing response activities and work in progress
• Needs: Outstanding requirements, blockers, and resource needs

Each update writes a new version and keeps the previous ones, so the record shows how the situation moved. Update it at a shift change or when something significant happens.

The investigation report

The main deliverable for a finished investigation, built from sections. It offers:

• Configurable section structure
• Rich text editing with Markdown support
• Dynamic content with evidence and image references
• Auto-generated sections (timeline, evidence inventory)
• QA review workflow
• Print-optimized output

Sections

An investigation report consists of sections.

Editable and generated

Sections fall into two categories:

• Editable sections: User-written content with Markdown support
• Generated sections: Auto-populated content from case data

What DFIRe generates

These sections are automatically populated based on case data:

• Title Page: Case details, dates, and team members
• Table of Contents: Auto-generated navigation
• Timeline: All timeline entries from the case
• Indicators of Compromise: All IOCs associated with the case, including values, types, classifications, public notes, and case-specific context notes
• Evidence Inventory: Complete list of evidence items
• Detailed Item Reports: Expanded evidence item details

Leaving a section out

A section template names where it appears:

• Incident cases only
• Investigation cases only
• Both incident and investigation cases

You can also drop a single section from one case's final report without deleting what it holds.

Writing

The editor

The report editor supports Markdown formatting:

• Bold, Italic, and other text formatting
• Headings (H1-H4)
• Bullet and numbered lists
• Block quotes
• Code blocks
• Tables
• Links

Saving

Changes are automatically saved as you type. After you stop typing, your changes are saved within one second. A save indicator shows when changes are being saved and when the save is complete.

Two people editing at once

DFIRe prevents conflicting edits when multiple users work on the same report:

• When you open a section for editing, it's locked to other users
• Other users see who is currently editing
• Locks are released automatically when you stop typing
• A 15-minute failsafe releases a lock if something goes wrong

Drafting with AI

When an LLM provider is configured, DFIRe can generate draft content for reports using AI. Generated content lands in the editor for you to review and edit. Nothing is finalized automatically.

A CAN report

On the CAN Report tab, click Generate with AI to produce a new CAN report version. DFIRe sends a snapshot of the case data to the configured LLM, which returns structured content for the Conditions, Actions, and Needs sections.

• You can provide additional instructions per generation (e.g., "Focus on the network intrusion aspects" or "Keep it concise for executive stakeholders")
• The generated report is saved as a new version, preserving existing versions
• Content can be edited after generation like any other CAN report

A report section

Editable report sections that have AI generation enabled show a generate button in the section editor. Clicking it sends the case data along with the section's AI prompt to the LLM, which returns Markdown content.

• The LLM receives the content of other report sections, allowing it to avoid repetition and maintain consistency across the report
• Each section can have its own tailored AI prompt configured by an administrator
• DFIRe appends the generated text to what the section already holds, then saves the section. Sections keep no version history, so remove anything you do not want to keep

For full details on how the LLM integration works, what data is sent, and how to configure prompts, see AI Integration.

Referring to evidence and files

Insert references to evidence items and images that automatically expand when the report is viewed or exported.

Evidence

Reference evidence items using the syntax:

{{evidence.<uuid>}}

When rendered, this displays the item's name, its type, and a short identifier. Use the reference picker in the editor toolbar to insert references without memorizing UUIDs.

To pull a single detail into a sentence instead of the whole reference, name the field: {{evidence.name.<uuid>}}, and likewise type, owner, user, or flags.

Images

Embed images from evidence attachments:

{{image.<size>.<id>}}

Available sizes:

• small - Thumbnail size
• medium - Half-width image
• large - Full-width image
• description - Inserts the image's description as text instead of the image

Attachments

Link to file attachments:

{{attachment.<id>}}

A single detail can be pulled out the same way: {{attachment.hash.<id>}}, and likewise filename, description, or size. Quoting an acquisition hash inline this way keeps it correct if the attachment is replaced.

Review before delivery

Each section moves through review on its own, so one author can keep writing while another is checked.

Section states

State	Description	Actions Available
Draft	Section is being written or revised	Edit content, submit for QA
Ready for QA	Author has submitted for review	Review, approve, or return to draft
QA Completed	Section has been reviewed and approved	Return to draft for revisions

Versions

Reports use a version number to track progress:

• 0.x (Draft): Report is work in progress. Minor version increments when sections are submitted for QA.
• 1.x (Finalized): Report has been finalized and is ready for delivery. Subsequent revisions increment the minor version.

How a review runs

1. Author writes section content
2. Author clicks "Ready for QA" to submit for review
3. Reviewer examines the section content
4. Reviewer either approves (QA Complete) or returns to draft with feedback
5. Once all sections are approved, the report can be finalized

Finalizing also fires the Report Finalized notifier event, which carries the case, the version and a link to the report. See Webhooks and Email.

Which sections exist

Section templates are configured once for the installation under Settings → Reporting, not per case or per playbook. An administrator decides the order, which sections are editable and which are generated, whether a section appears in incident reports, investigation reports or both, and which ones start excluded. See Configuration.

Template changes reach new cases. A report already under way keeps the sections it was created with.

Printing

Reports are optimized for printing and can be saved as PDF using your browser's print function.

The print layout

• Professional formatting optimized for print
• Table of contents for navigation
• All images and tables included
• Evidence references expanded inline
• Page breaks between sections as configured
• Excluded sections hidden automatically

Saving as PDF

To create a PDF:

1. Open the report in print preview mode
2. Use your browser's print function (Ctrl+P / Cmd+P)
3. Select "Save as PDF" as the destination
4. Adjust page settings if needed and save