The same finding cannot be told to a SOC analyst and a board in one document. A report that does not choose its reader reaches nobody.
Most intelligence reports reach nobody because they try to address everybody. The technical appendix loses the executive; the summary tells the analyst nothing.
Three separate outputs
- Analyst — indicators, queries, raw data and verification steps, in a machine-readable format.
- SOC lead — which detection rule is affected, which log source is needed, how many person-hours.
- Executives — which business process is at risk, what decision is expected, what happens without one.
A shared spine
All three derive from the same finding. Write the finding once: situation, evidence, confidence, impact, recommendation. Then shorten that spine per reader; do not rewrite it.
Confidence
Put a confidence level next to every claim and say what it rests on. "High confidence" without a stated source is an opinion.
