Automated shift report

Every SOC shift prepares a report on its work. Before, everyone did it their own way; my script unified it into one shared template.

Counting alerts by rule and copying the details from the SIEM into the template by hand on every shift is repetitive work.

I wrote a Python script that prepares the whole report: it detects the shift’s time range, pulls the alerts from the SIEM, groups them by rule and fills in the Word template. A PowerShell script on the employee’s account launches it.

Input

alerts from the SIEM for the shift period

Template

a Word document with the fields {{data}}, {{godziny}}, {{liczba_alertow}} and {{alerty}}

Output

a finished DOCX file

Running it

a PowerShell script on the employee’s account

1. 1

   Detect the shift

   The script checks the current time in the given time zone, works out which shift is running and sets its time range, converted to UTC for the query.

2. 2

   Fetch the alerts

   A query to the SIEM for the alerts from the current shift’s range.

3. 3

   Group by rule

   Every rule gets an alert count, and selected rule types also get the extra details the report needs.

4. 4

   Rule list in the template

   The {{alerty}} field becomes a bullet list in the template’s formatting, most frequent rule first: “rule: count: N× detail”.

5. 5

   Date, hours, alert count

   These fields are replaced directly in the DOCX XML, including text boxes, shapes, headers and footers, even when Word has split a field into several text fragments.

• WAF – reguła przykładowa A: 12: 8x [szczegół 1], 4x [szczegół 2]
• Windows – reguła przykładowa B: 4: 3x logon - lab-user01, 1x logon - lab-user02
• Windows – reguła przykładowa C: 2: 2x lab-admin01

A Word template instead of building from scratch

The report looks exactly like the agreed template; the script only replaces the content.

Replacing fields in the XML

python-docx doesn’t reach text boxes and shapes, and Word can split a field into several fragments, so some fields are replaced directly in the XML.

Details depending on the rule type

Different rule types need different details in the report, so the script picks them by rule type and falls back to the next field when one is missing.

The report is generated every day, usually on every shift, launched by a PowerShell script. The whole SOC team uses it.

• Details are broken down only for selected rule types; for the rest, the report gives only the alert count.
• I don’t publish the template or real reports; the example above is synthetic.