Narrative IntelligenceTHE SOLUTIONS INDEXStart with Minos ↗
The index/Field guides/Write the decision brief
G—08FIELD GUIDEOCTOBER 21, 2026

Narrative Threat Intelligence Report: Example and Template

A narrative threat intelligence report should make its reasoning inspectable. Give the reader the question, the observed evidence, the assessment and the limits before asking them to choose a next step.

2 MIN READ
THE SOLUTIONS INDEX

Start with the question and scope

Name the subject, decision, source categories, languages and collection period. Record important unavailable sources. The reader should understand the boundaries before encountering a confident-sounding conclusion.

Use this report format when you compare narrative intelligence platforms, so each demonstration is evaluated against the same evidence and briefing requirements.

A scope statement also explains whether the task is continuous monitoring, an investigation of one incident or a retrospective study. Each has different expectations for completeness and timeliness.

Use a concise report structure

SectionRequired content
QuestionThe decision the report supports
ScopeSubject, period, sources and gaps
Key observationsSource-linked facts and timestamps
AssessmentInterpretation, confidence and alternatives
OptionsPractical next steps and tradeoffs
Owner and reviewResponsibility and reassessment trigger
Evidence indexTraceable records behind conclusions

Illustrative executive summary

ILLUSTRATIVE EXAMPLE

During the defined review window, the same claim appeared in three collected source groups. Two publications linked to a common article; the remaining relationship is unresolved. The record supports further review of cross-channel spread, but does not establish who directed the activity. The communications owner will verify the underlying factual claim before considering a clarification.

This is a fictional format example, not a real investigation or product result. It deliberately separates the visible publication pattern, the unresolved relationship and the next decision.

Build an evidence index a reviewer can use

For each significant observation, retain an internal reference, original source, capture date and relevant excerpt or approved evidence record. Record whether the material is original, quoted or a repost.

Include enough context to test the conclusion. A timeline should expose uncertain timestamps and distinguish earliest collection from claimed origin. A network map should define its connections and link them to evidence.

Document confidence and revisions

Explain which parts of the assessment are well-supported and which remain tentative. Identify the missing information that would materially change a conclusion. Avoid a single confidence word with no explanation.

When the report changes, record what new evidence or reasoning drove the update. A correction should remain visible to the people who received the earlier version. Keep the final response decision separately attributable to its authorized owner.

Questions for the brief

How long should an executive narrative intelligence briefing be?

Use the shortest format that preserves the question, important findings, uncertainty and required decision. Keep the evidence index available separately so brevity does not remove the basis for the assessment.

Can I include a network diagram without publishing the underlying account evidence?

Restrict distribution as appropriate, but retain the evidence for authorized review. Define what each connection means and avoid presenting an unreviewable diagram as proof of a stronger claim.

What should I do if an important source disappears after the report is issued?

Record the change in availability and preserve any previously captured evidence under the approved retention process. Explain which conclusions still rely on an inspectable record and whether a limitation needs updating.

TAKE THE QUESTION TO A PROVIDER

Keep the brief
connected to the evidence.

Return to the comparison ↗