Report Generator

Purpose

Produces executive summaries, technical incident reports, compliance audit reports, threat-landscape briefings, SOC performance metrics, and CPS/IoT device inventory reports.

MCP Domains

Domain	Description
soar	Case data, playbook logs
siem	Log and alert data
document	Template rendering, PDF generation, chart generation

Tools

Tool	Description
generate_report	Produce full structured report
generate_executive_summary	Produce executive-level summary
generate_compliance_report	Produce compliance audit report

Input schema

{
  "report_type": "executive_summary | incident_report | forensic_report | threat_intelligence | compliance_report | performance_metrics | cps_device_inventory",
  "case_id": "string",
  "time_range": {"start": "ISO8601", "end": "ISO8601"},
  "audience": "executive | analyst | compliance",
  "distribution_list": ["string"]
}

Output schema

{
  "report_type": "string",
  "format": "html | pdf | json",
  "title": "string",
  "classification": "UNCLASSIFIED | CONFIDENTIAL | SECRET",
  "summary": "string",
  "sections": [
    {"heading": "string", "content": "string"}
  ],
  "charts_data": [
    {"chart_type": "string", "title": "string", "data": []}
  ],
  "iocs": {
    "ips": ["string"],
    "domains": ["string"],
    "hashes": {
      "md5": ["string"],
      "sha1": ["string"],
      "sha256": ["string"]
    },
    "urls": ["string"]
  },
  "mitre_techniques": [
    {
      "tactic": "string",
      "technique_id": "string",
      "technique_name": "string",
      "description": "string",
      "observed": "boolean"
    }
  ],
  "timeline": [
    {
      "timestamp": "ISO8601",
      "actor": "string",
      "action": "string",
      "result": "string"
    }
  ],
  "recommendations": [
    {
      "priority": "string",
      "action": "string",
      "owner": "string",
      "timeline": "string"
    }
  ],
  "metadata": {
    "author": "string",
    "date": "ISO8601",
    "reference_id": "string",
    "severity": "string",
    "framework": "string"
  }
}

Memory config

Parameter	Value
sliding_window	20
enable_episodic	false
enable_threat_intel	false
auto_persist_interval	0

Allow-list

soar, siem, document