How long does it take to generate a report from an event?

A few minutes. While it runs, the package shows as generating under Intelligence Packages for that organization.

Where do I find the finished report?

Open the organization you generated it for and go to its Intelligence Packages section.

Should I start from a Threat Event or from a single Event?

From the Threat Event, normally. It carries every report on the occurrence, so the package is grounded in all of the sourcing rather than one article. Start from a single Event when that one report is the point, for example a vendor advisory you want written up on its own.

Create a report from an event.

Last updated 6 Sept 20262 min read

When an occurrence is relevant to one or more of your Organizations, you can turn it into a tailored Intelligence Package in a few clicks. Liberty91's AI agents research it, reference your Intelligence Requirements and the specifics of the chosen Organization, and produce a relevant, actionable report you can review, edit, and send, with the IOC list, STIX bundle and detection rules alongside it.

You can start from a Threat Event, which is the usual route because it gathers every report on the occurrence, or from a single Event when that one report is what you want written up.

From a Threat Event

Open the Threat Event you want to report on.
In the header, beside Subscribe, click Create Intelligence Package.
If the Threat Event is relevant to more than one of your Organizations, the Relevance to Organizations card carries a button per Organization. Use the one for the Organization you want the package written for; each package is tailored to the Organization you pick.

The Relevance to Organizations card on a Liberty91 Threat Event, listing three Organizations, each with the Intelligence Requirement it matched and its own Create Intelligence Package button

From a single Event

Open the Event you want to report on.
Under the title, click Generate report.
Select the Organization you want to generate the report for. Each report is tailored to the Organization you pick.

Liberty91 event view with the Generate report button under the title and the organization selector open

The agents now work together to research the event, reference your Intelligence Requirements, and apply what they know about the Organization.

Note

A package takes a few minutes to generate. While it runs, it appears as generating under that Organization's Intelligence Packages.

Review and send

Open the Organization you generated the report for and go to its Intelligence Packages section.
Open the finished package and review it. Make any edits you think are necessary.
Click Stage for mailing and select the recipients you want to send it to.

Liberty91 Intelligence Packages list for an organization, showing generated packages with their kind, status, and artifacts

Open the package to read it. Review the analysis, make any edits, then stage it for mailing.

An open Intelligence Package in Liberty91 with the Report, IOCs, STIX, SIGMA, and Report PDF tabs, and the Regenerate analysis and Send report controls above the report title

Once you stage and send the package, it becomes trackable in the Mailroom. For the full sending flow and recipient options, see Send a report to a stakeholder.

Was this page helpful?

← PreviousGenerate a report from search results Next →Report on a threat entity or requirement