# Format Catalog

Report formats for case output. Select by audience and purpose.

---

## Format Index

| ID | Format | Pages | Audience | Purpose |
|----|--------|-------|----------|---------|
| F1 | leadership-brief | 1 | Exec / sponsor | Decision trigger |
| F2 | full-analysis | 5–15 | Analyst team | Complete record |
| F3 | plain-summary | 1–2 | Non-technical | Plain-language findings |
| F4 | evidentiary | variable | Legal / compliance | Court/audit ready |
| F5 | press-ready | 1–3 | Journalist | Publication-safe |
| F6 | threat-brief | 2–4 | Security ops | Actionable IOCs |
| F7 | comprehensive-profile | 10–30 | Senior analyst | Full subject record |

---

## F1 — Leadership Brief

**When:** Sponsor needs go/no-go input. Under 5 minutes to read.

```
╔══ LEADERSHIP BRIEF ═══════════════════════════════════════════╗
║  Case: [ID]                              Date: [YYYY-MM-DD]   ║
║  Classification: [INTERNAL / RESTRICTED]                      ║
╠═══════════════════════════════════════════════════════════════╣
║  SITUATION: [2 sentences — what and why]                      ║
║                                                               ║
║  KEY FINDINGS:                                                ║
║    1. [finding — 1 sentence]                                  ║
║    2. [finding — 1 sentence]                                  ║
║    3. [finding — 1 sentence]                                  ║
║                                                               ║
║  EXPOSURE LEVEL: [CRITICAL / HIGH / MODERATE / LOW]           ║
║  RECOMMENDED ACTION: [single sentence directive]              ║
╚═══════════════════════════════════════════════════════════════╝
```

---

## F2 — Full Analysis

**When:** Internal record for analyst team. Complete findings with sourcing.

**Sections (required order):**
1. Case metadata (ID, analyst, dates, scope)
2. Executive summary (≤150 words)
3. Subject registry (all subjects with confidence)
4. Findings log (each finding with source, weight, timestamp)
5. Connection map (text or visual)
6. Discovery paths attempted (with null results noted)
7. Exposure assessment
8. Appendix: raw citations

---

## F3 — Plain Summary

**When:** Client or stakeholder with no technical background.

**Rules:**
- No jargon without inline definition
- Lead with bottom line
- Use analogies for technical concepts
- Confidence labels: "we confirmed / we believe / we suspect"

**Structure:**
```
## Bottom Line
[1–3 sentences max]

## What We Found
✓ [positive finding in plain language]
⚠ [concern in plain language]

## What It Means
[analogy or real-world consequence]

## Recommended Steps
1. [action — specific, not vague]
2. [action]
```

---

## F4 — Evidentiary

**When:** Legal proceedings, HR actions, compliance audits.

**Requirements:**
- Each finding: source URL + archive URL + access timestamp
- Chain-of-custody notation for screenshots
- Analyst name + license/credential on cover
- No speculation — findings only, confidence stated explicitly
- Redaction log for any PII not relevant to matter

---

## F5 — Press Ready

**When:** Journalist publishing case findings publicly.

**Requirements:**
- Subjects anonymized unless public figures
- No unpublished PII
- All claims sourced to public record only
- Tone: neutral, factual, no editorializing
- Legal review flag before release

---

## F6 — Threat Brief

**When:** Security operations, incident response.

**Sections:**
```
INDICATORS:  [IP, domain, hash, email — table format]
TTPS:        [MITRE ATT&CK IDs if applicable]
EXPOSURE:    [what assets are at risk]
DETECTIONS:  [detection strings or signatures]
ACTIONS:     [block / monitor / escalate — prioritized]
```

---

## F7 — Comprehensive Profile

**When:** Deep case record on a high-priority subject.

**Includes all F2 sections plus:**
- Timeline (events sorted chronologically)
- Behavioral patterns
- Associate network diagram
- Historical finding log (archived snapshots)
- Confidence trajectory (how certainty changed over case)

---

---

## Auto-Save Policy (MANDATORY)

**Every report generated by `/report`, `/brief`, or `/case` is automatically saved to disk in two formats:**

1. **Markdown (.md)** — the source report with all ASCII art, tables, and formatting intact
2. **Word (.docx)** — converted via pandoc for sharing with non-technical stakeholders

**File naming:** `OSINT-REPORT-[CASE-ID]-[YYYY-MM-DD].md` and `.docx`
**Save location:** Current working directory, or `./osint-reports/` subdirectory if it exists.

This is non-optional. Every Deliver phase ends with both files saved and paths confirmed to the user.

See [`export-specs.md`](./export-specs.md) for DOCX generation details.

---

*See also: [`output/reports/citation-guide.md`](./citation-guide.md) | [`output/reports/export-specs.md`](./export-specs.md)*
