The report is the deliverable
The work only counts if it is written down. A good incident report has a one-paragraph summary, a timeline, the impact (what was accessed), the IOCs (attacker IP, C2 domain, web-shell path) and clear recommendations. It should let someone who wasn't there understand and act on the incident in five minutes.