## Writing Effective Intelligence Reports

The best analysis in the world is worthless if the report is confusing.

### 1. The BLUF (Bottom Line Up Front)
Executives do not read mystery novels. They want the spoiler on page 1.
*   **Structure**: State the **Key Judgment** and **Recommendation** in the first paragraph.
*   *Example*:
    > **Executive Summary**: We assess with High Confidence that the "Finance-Payroll" server is compromised by Ransomware. We recommend immediate network isolation of the entire Finance subnet to prevent spread.

### 2. Words of Estimative Probability (WEP)
Never use vague words like "Maybe", "Possibly", or "Might". They mean different things to different people.
Standardize your language (based on Intelligence Community Directives - ICD 203):

| Term | Probability | Meaning |
|---|---|---|
| **Almost Certain** | 90-99% | No doubt. Strong evidence. |
| **Likely / Probable** | 60-90% | Logical, supported by evidence, but gaps exist. |
| **Roughly Even Chance** | 40-60% | Could go either way. Ambiguous evidence. |
| **Unlikely** | 10-40% | Evidence suggests this is not the case. |
| **Remote** | < 10% | Highly improbable. |

*   *Bad*: "It might be Russia."
*   *Good*: "We assess with **Moderate Confidence** that the actor is Russian-aligned."

### 3. Audience Analysis
Write for the reader, not for yourself.
*   **Strategic Report (CISO/Board)**:
    *   **Focus**: Impact, Cost, Risk, Trends.
    *   **Language**: Business English. No "Hash values" or "IPs".
    *   **Length**: 1 Page max.
*   **Operational Report (SOC Manager)**:
    *   **Focus**: TTPs, Attribution, Campaign timeline.
    *   **Language**: Technical but explained.
*   **Tactical Report (Analyst/Engineer)**:
    *   **Focus**: IOCs, Signatures, Rules.
    *   **Language**: Raw Data (JSON/CSV). "Just give me the list."

### 4. Analysis vs Facts
Clearly separate **what you know** (Facts) from **what you think** (Assessment).
*   *Fact*: "The malware communicates with 1.2.3.4."
*   *Assessment*: "1.2.3.4 is likely a C2 server."
If you mix them, you mislead the reader.