Use Case: Incident Response
Automated incident reporting
The incident is contained. Now the team faces 6 hours of report writing — executive summary, technical brief, regulatory notification, and board metrics update. ManySignal generates all four drafts from the investigation case in 15 minutes.
6 hours of reporting after 12 hours of response
When a security incident is contained, the team's work is only half done. The remaining obligation is documentation: a technical report for the security team's records, an executive summary that non-technical stakeholders can understand, regulatory notifications with legally mandated timelines, and board metrics updates. These reports require pulling data from the same investigation records the team has already assembled — but they're written from scratch, creating inaccuracies and consuming hours of analyst time during the post-incident period when the team is already exhausted.
ManySignal generates report drafts directly from the investigation case. Every timeline event, affected entity, remediation step, and metric in the case becomes a structured report element. Analysts review and edit the drafts, not assemble them from raw logs.
Report types generated
- Executive summary — 1 page, plain English, timeline + business impact
- Technical report — Full detail: IOCs, ATT&CK mapping, evidence chain
- Regulatory draft — GDPR Article 33, HIPAA, SEC pre-structured format
- Lessons learned — Detection gaps, response gaps, recommendations
- Board metrics — MTTD, MTTR, volume trends, coverage status
Regulatory deadline tracking
workflow: incident_report_generation
trigger: incident.status = "contained" OR "closed"
inputs: case_data (timeline, entities, evidence, remediation)
generate:
executive_summary:
- what_happened: plain_english (2 paragraphs)
- business_impact: systems_down, data_affected, duration
- actions_taken: containment + remediation steps
- current_status: resolved / monitoring / pending_patch
technical_report:
- timeline: all events with timestamps and sources
- attack_chain: initial_access -> persistence -> exfil
- ioc_list: sha256_hashes, ips, domains, urls
- attack_mapping: mitre_attack_techniques
- evidence_hash: sha256 of all source evidence
regulatory_draft:
- detect: applicable_regulations from org_config
- populate: breach_date, discovery_date, data_types
- estimate: record_count from access_log analysis
- deadline: calculated from incident_discovery_timestamp
delivery:
- pdf: all report types
- docx: executive_summary + technical_report (editable)
- case_attachment: linked to investigation recordMITRE ATT&CK context
Incident reporting FAQ
What report formats does ManySignal generate for incident reporting?
ManySignal generates: executive summary (1 page, non-technical, suitable for board and C-suite), technical incident report (full analyst-grade detail, IOCs, timeline, remediation), regulatory notification draft (pre-structured for GDPR Article 33, SEC incident disclosure, HIPAA breach notification), and metrics report (MTTD, MTTR, affected asset count, data volume). All formats are editable in ManySignal's document editor before export.
Does ManySignal track regulatory reporting deadlines?
Yes. When an incident is classified with a data breach indicator, ManySignal starts deadline tracking based on your configured regulatory obligations. GDPR requires 72-hour supervisory authority notification; HIPAA requires 60-day notification for breaches affecting 500+ individuals. ManySignal shows a countdown and reminds the assigned analyst as deadlines approach.
Can ManySignal generate reports for historical incidents if investigation data is in ManySignal?
Yes. Any incident with a complete ManySignal investigation case can have a report generated retroactively from the case data. The report pulls the timeline, affected entities, evidence summary, and remediation steps directly from the investigation record. This ensures report accuracy matches the actual investigation rather than relying on analyst memory.
How does ManySignal populate metrics for board-level security reporting?
ManySignal maintains a continuous metrics database tracking: alert volume by category, MTTD and MTTR by incident type, false positive rate, coverage gap status, and open vulnerability count by severity. Board reporting templates pull directly from this database, producing charts and trend lines without manual data collection. Reports can be scheduled monthly or quarterly.
Generate all four incident reports in 15 minutes, not 6 hours
Executive summary, technical brief, regulatory draft, and board metrics — all from the investigation case you already built.