AnalystLog turns raw security investigation notes into structured, professional SOC reports mapped to 9 industry frameworks. Paste what you wrote during a lab, CTF, or live incident — get back a report you can put in front of a hiring manager or an incident review.

Creating your first report

1. Create an account and pick a username — it becomes your public portfolio URL.
2. From the dashboard, click + New Report.
3. Paste your raw notes (50–10,000 characters) and optionally pick a scenario hint like Phishing/BEC or CTF Challenge.
4. Click Generate report and wait 20–30 seconds.
5. Review the report, then keep it private or publish it to your portfolio.

The free plan

Free accounts include 3 reports with all 9 framework mappings, stored privately. Pro ($9/month) adds unlimited reports, public portfolio publishing, PDF export, and a higher generation rate limit (30/hour vs 10/hour).

You don't need perfect notes. Half-sentences, shorthand, and messy timestamps are fine — paste whatever you have. Structure is AnalystLog's job, not yours.

What to include

• Timestamps — even rough ones, in whatever timezone you noted them
• IPs, domains, URLs, file names, and hashes
• Tool output — EDR alerts, SIEM queries, Wireshark filters, command lines
• Your own observations and hunches, however unpolished

What AnalystLog does with them

The AI classifies the scenario, reconstructs the timeline, extracts and defangs every indicator, maps observed behavior to the applicable frameworks, and writes the narrative sections. Anything your notes don't support gets flagged [ANALYST TO VERIFY] instead of invented.

Example raw notes

10:42 - EDR alert, powershell.exe spawned from winword.exe on WS-0413
10:47 - pulled email from quarantine, attachment invoice_0423.docm
sender domain registered 3 days ago, reply-to mismatch
b64 encoded command in ps logs -> downloads from 185.220.101[.]42
blocked hash on EDR, isolated host 11:03
no lateral movement seen in last 24h of logs

Six lines like these are enough for a complete nine-section report.

Every report follows the same nine-section structure:

What [ANALYST TO VERIFY] means

Wherever your notes are ambiguous, incomplete, or can't support a claim — a timeline gap, a partial indicator, an inferred step — the report inserts the literal flag [ANALYST TO VERIFY] with a note on what needs checking. This is a feature, not a weakness: real incident reports mark their own uncertainty, and reviewers trust reports that do.

The framework version footnote

Every report ends with a footnote listing the exact framework versions used (e.g., ATT&CK v19, D3FEND v1.3.0). Frameworks rev regularly and technique IDs can change between versions — the footnote makes your mappings auditable years later.

Making a report public

Open any report and click the ○ Private toggle to switch it to ● Public. Public reports appear instantly on your portfolio page; flip the toggle back any time to unpublish.

Your portfolio URL

Your portfolio lives at analystlog.com/u/your-username — no sign-in required to view it. Each public report also has its own shareable URL, which you can copy with the Copy portfolio link button on the report page.

Sharing with recruiters

Put your portfolio URL on your CV and LinkedIn next to your certs. When a hiring manager asks "have you actually worked an incident?", you send a link instead of an anecdote.

What employers see

Your display name, bio, and public reports only. Private reports, your email, and your raw notes are never visible. Reports render in the same terminal-style format you see in the dashboard — severity, framework badges, full nine-section write-up.