Security Reporting

Reporting in ThreatStream Next Gen is where your threat intelligence work comes together into something you can share, communicate, and act on. It allows you to turn raw intelligence into clear, structured, and executive-ready reports that stakeholders across your organization can easily understand and use.

A report is a structured summary of a security issue, investigation, or intelligence topic. Depending on how it is created, a report may include an executive summary, an overview of the threat, affected assets, attribution details, targeted infrastructure, observables, a risk assessment, and recommended actions. Some reports are designed for leadership and focus on high-level insights, while others provide more detailed technical analysis for security teams.

You can create reports in several ways. Reports may be generated automatically from Priority Intelligence Requirements (PIRs), created manually to document specific investigations, or assisted by Anomali AI to streamline the process. Regardless of how they are created, all reports along with any shared with you by other organizations are centralized on the Security Reporting page. From there, you can view and manage reports based on attributes such as name, author, creation date, visibility, TLP classification, and status, making it easier to organize and track your reporting over time.

Templates play a key role in making reporting efficient and consistent. A template defines the structure of a report by organizing it into predefined sections, so you do not need to build reports from scratch. This allows you to focus on analysis rather than formatting, while ensuring that important information is consistently included. Templates also help standardize reporting across your team, making reports easier to read and compare.

ThreatStream Next Gen includes a set of ready-to-use templates, and also allows you to create custom templates tailored to the needs of your organization.

Overall, reports help security analysts transform complex and distributed threat data into clear and standardized communication. Reports support consistent reporting practices, improve efficiency, and ensure that the right level of information is delivered to the right audience—whether technical analysts or executive stakeholders.