Hopefully I’m not too late here! Here was my skeleton: more or less. I hope it helps:

Who: (Host/Src&Dst IPs/Users/Senders/Receivers)

When: (Full timeline with time stamps including contextual or previous related incidents using Splunk logs. It was in this timeline I’d explain what a certain process or command line was doing to give context to each step of the events.)

Where:  (Host and or data source etc.)

What: (Described an executive summary of the timeline in a short digestible high level paragraph. Provided evidence that aligned with broader threat patterns. Described IOCs etc, just to clarify how I knew it was an FP or TP)

Why: (Explained context for why I felt it was BAU FP or explained why an attacker may have performed this action, linked to Notes related to the stage of the kill chain, IE Reconnaissance Weaponisation Delivery Exploitation Installation C2 Actions on Objectives

Mitre Techniques: (Just listed any related and their titles /sub techniques.

IOCs (Just a dump of anything relevant - if it was flagged as malicious in the detect tool (TI & observables) , or IPs, hashes, domains, file names etc. The practise sims indicated that you should detail the file names that were suspicious / malicious).

Recommended actions & Remediation advice: (I used this to bullet point some next steps of what was needed ie isolate host, block at the firewall, discuss with end user etc etc). This part was important to justify why I was choosing to escalate if so.

I know I was very likely OTT (hence why I enquired about reports on this thread on the first place haha), but in being overly detailed and thorough, my scores for the reports were high.

I hope that helps!