Publish a reviewable triage report
Produce machine-readable findings and a summary that states what the results mean.
Give the next person a usable result
A report should let another analyst review the detail without rerunning your whole session. CSV works well for a flat findings table; JSON can express a summary containing a host array. Keep the two files consistent by deriving both from the same in-memory collection.
The supplied findings are leads, not confirmed incidents. Use the explicit status Needs review. A count says how many findings the rules produced, not how many attacks occurred. Several findings may describe related activity.
Preserve the trail back
Retain FindingId, Rule, and SourceIds alongside the computer and detail. These fields tell a reviewer why a row exists and where to look next. Do not replace the evidence IDs with a friendly sentence that cannot be traced.
$rows = @(Get-Content '/home/user/findings.json' -Raw | ConvertFrom-Json)
$rows | Group-Object Rule | Select-Object Name, Count
Keep Hosts an array even if a later case has only one computer. Use @(...) around the unique sorted host values. Specify sufficient JSON depth for the shape you export; truncating nested objects changes the saved data.
Re-import both files after writing them. The checker assesses saved fields and values, so formatting the terminal output is optional. In a real workflow, also document scope, collection gaps, and rule versions alongside the report.
Get-Content '/home/user/findings.json' -Raw | ConvertFrom-Json | Group-Object Rule | Select-Object Name, Count
Put it into practice.
Export findings.json to /home/user/findings.csv preserving FindingId, Computer, Rule, SourceIds, Detail. Write /home/user/summary.json with CaseId LAB-104, Status Needs review, FindingCount, and a sorted unique Hosts array. Derive counts and hosts from the supplied findings; output files are assessed after re-import.
See an explained solution
$findings = @(Get-Content '/home/user/findings.json' -Raw | ConvertFrom-Json)
$findings | Select-Object FindingId, Computer, Rule, SourceIds, Detail | Export-Csv '/home/user/findings.csv' -NoTypeInformation
[pscustomobject]@{
CaseId='LAB-104'; Status='Needs review'; FindingCount=$findings.Count
Hosts=@($findings.Computer | Sort-Object -Unique)
} | ConvertTo-Json -Depth 5 | Set-Content '/home/user/summary.json'
Both formats come from the same collection. The summary describes reviewable findings, preserves an array for hosts, and avoids claiming confirmed compromise.