ORIGINAL REDDIT POST
Do you guys use reporting tool or write it manually each engagement?
Each time I write a report I copy paste the finding table along with a lot of other shit. I end up spending a lot of time fixing the format of the doc. Do you guys use a reporting tool where you can write the bug description, impact and have it automatically…
Each time I write a report I copy paste the finding table along with a lot of other shit. I end up spending a lot of time fixing the format of the doc. Do you guys use a reporting tool where you can write the bug description, impact and have it automatically prepared for you??
Collected discussion
You could just give claude the template?
Team plan isn't good enough? For what we're working on not training on our data is good enough.
Lol I mistakenly give a client name to Claude last week and have been losing sleep since. No way I give it a template with findings in it. However I always use it but hide the client name, bur for paraphrasing and stuff. Not handling the whole document
If you can't use it for sensitive data one alternative is to tell it to write a small program to do what you want. Then it's an offline tool. Results will vary depending on what you need it to do but I've been able to create some very useful tools for repeatable tasks.
At my org, unless you’re on our enterprise instance, you feeding the incident into Claude with internal data is a breach.
PlexTrac is supposed to help with that. I would see them at good conferences.
You don’t have to feed internal data though. You can simply redact it or anonymise it e.g. the user end point on acmecorp’s sales app is vulnerable to IDOR.
We use IRIS. Can just open a new case and then fill everything out during the incident and click generate report at the end. Has asset tracking, task tracking, timeline, IOC tracking and associating, place for notes, and can store evidence, but we don't use that part.
You can try AttackForge. There’s also a bunch of other tools listed here: https://inventory.raw.pm/tools.html#title-tools-collaboration-and-report
For dedicated tools, look at PlexTrac or AttackForge if your company has budget, or self-host SysReptor if you need something free/open-source. If you're stuck using Word because of company templates, write a quick local Python script to auto-populate a .docx file using a centralized JSON findings library. Wrestling with table borders and page breaks manually is a waste of your time.