What goes in the report

Short, plain, and useful

A report does not need fancy words. It needs three things anyone can read:

• What happened — one or two sentences.
• The clues — the attacker's address, the backdoor account name, the files they left. (Security people call these indicators of compromise, or IOCs.)
• What you did — the exact things you removed or locked.

Here is the shape of a tiny report:

cat /tmp/report.example

In the terminal

student@vulntech:~$ cat /tmp/report.example
What happened: attacker logged in over SSH and added a backdoor account.
Clues: attacker IP 198.51.100.77, account svc-mon, service evilcron.service.
What I did: deleted svc-mon, removed evilcron.service.

Tip: Write the report as you work, not at the end. Paste each clue in the moment you find it, so nothing gets forgotten.