Writing up what you found

Short, and full of facts

The write-up for a capture is just the four answers, turned into plain sentences, plus the indicators anyone else can act on: the attacker's address, the suspicious domain, the ports that were scanned, and any password that leaked. Here is the shape:

cat /tmp/summary.example

In the terminal

student@vulntech:~$ cat /tmp/summary.example
Scanner 203.0.113.66 hit 8 ports on 10.10.10.5.
Victim looked up C2 domain sync-update-cdn.net.
Password SpringTime2026 leaked over plain HTTP.

Tip: Anyone reading your write-up should be able to block the attacker and the domain, and reset the password, without re-opening the capture themselves.