Chronological account of the engagement - Each phase: what was attempted, what succeeded, what was detected - ATT&CK technique mapping for every action - Evidence (screenshots, logs, artifacts)