Reports

Reports

prohori report turns an incident into a document you can read, share or archive.

uv run prohori report samples/incidents/INC-ee7c8818fbb34989.json                  # Markdown
uv run prohori report samples/incidents/INC-ee7c8818fbb34989.json -f html -o report.html
uv run prohori report samples/incidents/INC-ee7c8818fbb34989.json -f csv -o timeline.csv
uv run prohori report incidents.jsonl --incident INC-597217faa07b7dc8              # pick one

The input is an incident file, or the JSON Lines written by prohori incidents -f json (choose one with --incident when there are several). On Windows, use -o FILE rather than >: PowerShell would save the file in a different text encoding.

Formats

Format	Use it for
md (default)	Tickets, wikis, pull requests
html	Sharing: one file that opens offline, with no scripts and nothing loaded from the internet
json	Feeding other tools
csv	The timeline in a spreadsheet

What a report contains

1. Title, incident id, severity and score, confidence and time range.
2. A short summary and the main reasons for the score.
3. The timeline of events and alerts.
4. IP addresses with their lookup results, and user agents.
5. The accounts, addresses and requests involved.
6. The evidence: each alert with its rule and explanation.
7. ATT&CK tactics and techniques.
8. The score breakdown.
9. Recommended actions from the runbooks.
10. Confidence and limitations.
11. An appendix with SHA-256 fingerprints of the log file, the rule files and the incident file, and the versions used, so anyone can check what the report was made from.

The same incident always gives exactly the same report.

Sharing safely: --redact

uv run prohori report INCIDENT.json --redact -f html -o shareable.html       # hide accounts
uv run prohori report INCIDENT.json --redact-ips -f html -o shareable.html   # hide IPs too

• Account names, user ids, email hashes and email addresses become stand-ins such as [user:fb05937cd0]. --redact-ips also hides IP addresses.
• The stand-ins use a new random key each run, so nobody can work out the real values, and two redacted reports cannot be matched up.
• Before writing, Prohori checks that no original value is left anywhere. If one is, it writes nothing and exits with code 1.
• Not hidden: incident, alert and event ids (one-way fingerprints), rule ids, country and network owner, and the input file's name. Read a report before sharing it outside your organisation.

Safe against hostile logs

Log lines come from attackers. A report never runs their content: HTML is escaped and carries a strict Content-Security-Policy, Markdown cannot gain links or HTML, CSV cells cannot become spreadsheet formulas, and terminal escape codes are removed. Tests feed hostile content through every format.

Details: docs/REPORTS.md.