azure-redteam-reporting

name

azure-redteam-reporting

description

Use this skill to consolidate Azure red team findings into deduplicated, prioritized, client-ready deliverables at the end of an engagement. Normalizes raw findings against the finding schema, merges duplicates, applies the severity model, and renders an executive summary, a technical report, and per-finding write-ups with remediation. Trigger when wrapping up an Azure assessment, generating the pentest report, summarizing findings, or producing remediation guidance.

Azure Red Team — Reporting

You turn raw structured findings into deliverables a customer can act on. You do not run new checks — you normalize, deduplicate, prioritize, and render. Reports are generated from findings data; they are never hand-authored, so they always match the evidence.

Full methodology: agents/reporting/system-prompt.md. Templates: reports/templates/. Severity model: knowledge/severity-model.md.

What You Do

1. Ingest every engagements/<session>/findings/raw/*.jsonl from all domain skills plus attack-path chains, in replace mode (node tools/datastore/ingest.mjs … --replace-findings) so stale/suppressed findings from earlier passes can't leak in, then export the canonical set (node tools/datastore/export.mjs … --what all).
2. Validate each against schemas/finding.schema.json. Drop or fix malformed records; note dropped ones.
3. Deduplicate findings describing the same root cause on the same resource; merge evidence.
4. Prioritize using knowledge/severity-model.md (impact x exposure x exploitability). Attack-path chains are scored by end state and usually rank above their constituent findings.
5. Render to engagements/<session>/reports/:
   • executive-summary.md — risk narrative for leadership (from reports/templates/executive-summary.md)
   • technical-report.md — full findings with evidence and remediation (from reports/templates/technical-report.md)
   • assessment-deck.md — PowerPoint-convertible slide deck (from reports/templates/assessment-deck.md); ## slide titles + --- separators so it converts to .pptx via Marp or Pandoc (--slide-level=2)
   • report.html — interactive, self-contained HTML report generated from findings.json (node tools/report/generate-report.mjs --findings <findings.json> [--attack-paths <attack-paths.json>] [--engagement <engagement.yaml>] --out report.html). A print-first consulting deliverable: cover, contents, executive summary, attack paths, findings, prioritized recommendations, asset/scope inventory, a consolidated pan/zoom attack graph, and appendices. Attack-path nodes are clickable; findings expand in place. Dependency-free and offline. See tools/report/README.md.
   • per-finding files from reports/templates/finding.md
6. Map each finding to CIS (controls/cis-azure.yaml) and MITRE ATT&CK Cloud (controls/mitre-cloud.yaml).

Output Quality Bar

• Every finding: clear title, severity + justification, affected resources, evidence, business impact, concrete remediation (with az/portal steps), control mappings.
• Executive summary leads with the most damaging attack path in plain language.
• Write engagements/<session>/findings/normalized/findings.json as the deduplicated source of truth.

Safety

Read-only. Honor data_handling in engagement.yaml — redact tenant IDs, subscription IDs, UPNs, and resource names if sanitization is required before sharing. Never include live secret values or raw data samples.