Reporting and documentation in Cybersecurity - Mini Project: Build & Apply

Creating a Cybersecurity Incident Report

📖 Scenario: You work in a cybersecurity team. Your job is to document incidents clearly and accurately so others can understand what happened and how to fix it.Imagine a recent incident where a phishing email was detected and blocked. You need to create a simple report that captures key details.

🎯 Goal: Build a clear cybersecurity incident report step-by-step. You will create the data, add configuration details, write the main report content, and finalize it for sharing.

📋 What You'll Learn

Create a dictionary with exact incident details

Add a variable for the incident severity level

Write a summary paragraph using the data

Add a final note about next steps

💡 Why This Matters

🌍 Real World

Cybersecurity teams must document incidents clearly so others can understand what happened and how to respond.

💼 Career

Writing clear reports is essential for communication between security analysts, management, and other teams.

1

Create the incident data dictionary

Create a dictionary called incident with these exact entries: 'type': 'Phishing Email', 'detected_by': 'Email Filter', 'action_taken': 'Blocked', 'time': '2024-06-01 10:15'.

Cybersecurity

# Create the incident dictionary with exact keys and values
# Your code here

Hint

Use curly braces to create a dictionary and include all keys exactly as shown.

2

Add the incident severity level

Add a variable called severity and set it to the string 'High'.

Cybersecurity

incident = {
    'type': 'Phishing Email',
    'detected_by': 'Email Filter',
    'action_taken': 'Blocked',
    'time': '2024-06-01 10:15'
}
# Add the severity variable below
# Your code here

Hint

Just create a variable named severity and assign the string 'High'.

3

Write the incident summary paragraph

Create a variable called summary that uses an f-string to combine the incident dictionary values and severity variable into this exact sentence:
"Incident: Phishing Email detected by Email Filter at 2024-06-01 10:15. Action taken: Blocked. Severity level: High."

Cybersecurity

incident = {
    'type': 'Phishing Email',
    'detected_by': 'Email Filter',
    'action_taken': 'Blocked',
    'time': '2024-06-01 10:15'
}
severity = 'High'
# Create the summary string using an f-string below
# Your code here

Hint

Use an f-string with curly braces to insert dictionary values and the severity variable exactly as shown.

4

Add the final next steps note

Create a variable called next_steps and set it to the string 'Review email filter rules and train staff on phishing awareness.'

Cybersecurity

incident = {
    'type': 'Phishing Email',
    'detected_by': 'Email Filter',
    'action_taken': 'Blocked',
    'time': '2024-06-01 10:15'
}
severity = 'High'
summary = f"Incident: {incident['type']} detected by {incident['detected_by']} at {incident['time']}. Action taken: {incident['action_taken']}. Severity level: {severity}."
# Add the next_steps variable below
# Your code here

Hint

Just assign the exact string to the variable next_steps.

Practice

1. What is the main purpose of reporting and documentation in cybersecurity?

easy

A. To track and communicate security events clearly

B. To create complex technical diagrams

C. To develop new software features

D. To encrypt sensitive data

Solution

1. Step 1: Understand the role of reporting

   Reporting helps keep a record of security events and incidents.

2. Step 2: Understand the role of documentation

   Documentation explains issues, actions taken, and recommendations clearly.

3. Final Answer:

   To track and communicate security events clearly -> Option A

4. Quick Check:

   Reporting and documentation = clear communication [OK]

Hint: Reports explain events simply and clearly [OK]

Common Mistakes:

• Confusing reporting with software development
• Thinking documentation is only for diagrams
• Assuming encryption is part of reporting

2. Which of the following is the correct way to start a cybersecurity incident report?

easy

A. Include a detailed list of unrelated software bugs

B. Write only technical jargon without explanation

C. Skip the introduction and jump to recommendations

D. Begin with a clear summary of the incident

Solution

1. Step 1: Identify the report structure

   A good report starts with a clear summary to set context.

2. Step 2: Evaluate options

   The other options do not provide clarity or proper structure.

3. Final Answer:

   Begin with a clear summary of the incident -> Option D

4. Quick Check:

   Start reports with summaries [OK]

Hint: Start reports with a clear summary [OK]

Common Mistakes:

• Including unrelated information
• Using too much jargon
• Skipping important sections

3. Consider this excerpt from a security report:

"The firewall was breached at 03:00 AM. Immediate action was taken to block the IP address 192.168.1.10. No data loss detected."

What is the main purpose of this statement?

medium

A. To explain how to configure a firewall

B. To list all IP addresses in the network

C. To describe the timeline and response to a security event

D. To provide a detailed technical manual

Solution

1. Step 1: Analyze the content of the statement

   The statement shows when the breach happened and what action was taken.

2. Step 2: Identify the purpose

   It summarizes the event timeline and response, not configuration or manuals.

3. Final Answer:

   To describe the timeline and response to a security event -> Option C

4. Quick Check:

   Report statements = event timeline and response [OK]

Hint: Look for event time and actions in reports [OK]

Common Mistakes:

• Confusing event description with configuration instructions
• Assuming all IPs are listed
• Thinking it's a manual

4. A cybersecurity report contains this sentence:

"The system was compromised due to a weak password policy, but no further details are provided."

What is the main problem with this documentation?

medium

A. It lacks specific details needed for understanding and fixing the issue

B. It uses too many technical terms

C. It is too long and detailed

D. It includes irrelevant information about unrelated systems

Solution

1. Step 1: Review the sentence content

   The sentence states a cause but does not explain details or next steps.

2. Step 2: Identify documentation quality issue

   Good reports must provide enough detail to understand and fix problems.

3. Final Answer:

   It lacks specific details needed for understanding and fixing the issue -> Option A

4. Quick Check:

   Reports need clear, detailed info [OK]

Hint: Check if report explains cause and fix clearly [OK]

Common Mistakes:

• Thinking too much detail is bad
• Confusing lack of detail with jargon
• Ignoring missing actionable info

5. You are tasked with creating a cybersecurity report after a phishing attack. Which approach best ensures the report is effective and useful?

hard

A. Write a long technical explanation with many acronyms and no summary

B. Include a clear summary, factual details, actions taken, and recommendations

C. Focus only on blaming the user who clicked the link

D. Skip documenting the incident to save time

Solution

1. Step 1: Identify key report elements

   An effective report includes summary, facts, actions, and recommendations.

2. Step 2: Evaluate options for usefulness

   The other options fail to provide clear, helpful, and respectful documentation.

3. Final Answer:

   Include a clear summary, factual details, actions taken, and recommendations -> Option B

4. Quick Check:

   Good reports = clear + factual + actionable [OK]

Hint: Use clear summary and facts with recommendations [OK]

Common Mistakes:

• Using too much jargon
• Blaming individuals instead of facts
• Skipping documentation