CRTO Reporting
Purpose and mental model
The final report is a primary engagement deliverable. It should accurately explain whether the agreed objectives were met, what was found, what the findings could mean for the business, and what the organization can do next. A useful report connects objective → observed attack path → evidence → business impact → recommendation. It should make clear what was demonstrated and what remains only a plausible risk.
Engagement reporting vs. CRTO exam closeout This chapter teaches client-facing reporting for a red-team engagement; it is not an exam writing requirement. Ryan's first-hand exam workflow review and saved instructions, checked 6 November 2026, indicate that the CRTO platform grades the attempt and produces a score/OPSEC report, with no candidate-written report required. Inspect that platform report after grading and follow the exam's closeout instructions. This exam-specific note comes from Ryan's review and saved instructions, not from a claim verified on the public course page; see 00d. CRTO Exam State.
Diagram source
flowchart LR
A[Operator logs and evidence] --> B[Cobalt Strike reports]
A --> C[Red team report]
B --> C
C --> D[Executive out-brief]
C --> E[Technical out-brief]
Cobalt Strike output and operator notes are source material. The red team report is the curated explanation for the client; it can use tool reports as appendices when useful, but raw generated reports are not usually the main client deliverable.
Cobalt Strike generated reports
The course describes reports available from the Reporting menu. They summarize data recorded by Cobalt Strike; their coverage depends on what the platform observed and recorded. If connected to multiple team servers, the course says the report generator aggregates and orders their data.
| Report | What it summarizes |
|---|---|
| Activity | Timeline of recorded post-exploitation activity. |
| Hosts | Collected information about hosts, such as services, credentials, and sessions. |
| IOC | Technical indicators and C2 profile details, such as domains, traffic characteristics, and file hashes. |
| Sessions | Recorded post-exploitation activity organized by session. |
| Social engineering | Activity from Cobalt Strike's built-in spear-phishing capability, such as clicks and system-profiler information gathered. |
| TTP | Recorded activity mapped to MITRE ATT&CK. |
Treat these as supporting records, not as proof that the report is complete or that every recorded action succeeded. Validate important claims against operator logs and collected evidence. Include generated reports as appendices only when they help the intended audience.
Client-facing red team report
The course presents these common sections; the final structure should fit the engagement and its audience.
Executive Summary
Write for business leadership. State the objective and outcome, the most important findings, and the business risks in concise, nontechnical language. Do not bury the answer in tool names or procedure details.
Goals and Scenario
Summarize the agreed scope, goals, scenario, and testing model. Reuse the relevant parts of the rules of engagement (ROE), while making any material assumptions or deviations clear.
Attack Narrative
Explain the sequence of events that led toward or reached the objective. This is the main technical story. Include only the commands, output, timestamps, and screenshots needed to make the path reproducible and the claim verifiable. Keep evidence tied to the actor, target, time, and result.
Observations and Recommendations
An observation describes a weakness in the organization's ability to prevent, detect, or respond to an activity. Connect each observation to the attack narrative and evidence, then explain the consequence and one or more practical recommendations. For example, a credential-access path could expose weak credential controls, missed detection opportunities, or response gaps; state only what the engagement evidence supports.
Conclusion
Restate the key findings, their significance, and the overall business risk. Avoid claiming compromise or impact beyond what was actually demonstrated.
The Red Team Guide report template is a starting point, not a mandatory format. Adapt any template to the client's objectives, ROE, evidence-handling requirements, and audience.
Out-briefs
An executive out-brief is held soon after the engagement and is tailored to management. Recommendations can require changes to staffing, funding, process, or technology, so leadership needs to understand the business impact well enough to prioritize and sponsor those changes.
One or more technical out-briefs may bring the red team together with technical staff, including the blue team, to review activity, evidence, detection, response, and outcomes in detail. This is a chance for both offensive and defensive teams to learn from the exercise and clarify what the report says.
Evidence and report-writing checklist
- State the agreed objective, scope, scenario, and whether each objective was met.
- Build the narrative from contemporaneous operator notes, timestamps, tool logs, and preserved evidence.
- Separate a verified result from an inferred or potential path.
- Explain impact in terms meaningful to the business; do not equate technical access with business impact without evidence.
- Tie each observation and recommendation to the demonstrated path and relevant defensive gap.
- Tailor the executive and technical material to their readers.
- Review screenshots, logs, and appendices for unnecessary secrets or sensitive data before sharing.
- Confirm the report accurately reflects scope, limitations, deviations, and cleanup status.
Tooling and cost note
Cobalt Strike can generate useful operational reports, but those reports do not replace the analyst's synthesis or client-facing report. The course discussion cited a cost of roughly US$3,500 per user; treat that as a historical/course-era estimate, not current pricing. Fortra currently directs prospective buyers to request a quote, so licensing cost should be verified with the vendor when it matters. The thought that a team might build its own command-and-control tooling to avoid cost is a personal reaction, not a general recommendation: tooling decisions also depend on capability, maintenance, security, support, legal authorization, and the engagement requirements.
Fact-check status
- Report purpose, common report sections, and out-brief distinctions: recorded from the user-provided CRTO lesson notes.
- Red Team Guide template: linked as the course-recommended starting resource; template content can change.
- Current Cobalt Strike price: not publicly stated on the vendor quote page; the course's approximate figure is preserved only as historical context.
- Generated report labels and descriptions: course-provided summary; exact coverage and UI may vary by Cobalt Strike version and recorded data.
Review prompts
- If the objective was not reached, how would you report the strongest verified progress without implying success?
- Pick one attack-path observation. What evidence proves it, what business impact is demonstrated versus only possible, and which recommendation addresses the cause?
- Which information belongs in the executive summary, technical narrative, and appendices? What would you leave out of a raw tool report before sharing it?
- How would an executive and a blue-team analyst use the same engagement report differently?
Related notes
- 1. Red Team Engagements
- Post-Exploitation
- 00a. CRTO Detailed Command Reference and Archive (closeout and reporting workflow)
This is a living study note. Sources and understanding may change as it is reviewed.
