Automated triage reports
The intended report is a reviewable record of early findings. It should help an analyst explain what was observed, where it was observed, and what remains unknown. It must not turn a generated hypothesis into a confirmed behavior.
Evidence to preserve
Section titled “Evidence to preserve”Useful provenance includes the sample hash, import language, application version, enabled analyzers, function addresses, relevant references, and tool warnings. A report should distinguish static evidence from behavior observed through separate execution or debugging.
Review names, strings, and call relationships in their original context. An imported function name alone does not establish that a program performs a particular action on every path.
Before sharing
Section titled “Before sharing”- VERIFY report format, output destination, and overwrite behavior.
- VERIFY which sample names, paths, strings, symbols, and analyst comments are included.
- VERIFY redaction controls and cloud-processing consent.
- VERIFY failure and timeout indicators, citations, and reproducibility metadata.
- VERIFY that unsupported claims remain explicitly uncertain.
Begin with Projects and Auto analysis. Pattern scanning is a separate planned source of candidate findings, not a requirement for a baseline investigation.