Client Communication & Reporting

Client communication is where MSSP analysts spend a surprising amount of time: writing status emails, building incident summaries in Word, and copy-pasting metrics into slide decks. Seliq eliminates the blank page. It drafts every client-facing communication from the incident data it already holds, and your analyst reviews and sends.

Report types

Seliq generates three types of client-facing documents:

Incident notification

Sent when an incident is opened or changes status. Answers: “Something happened — here’s what we know right now.”

Severity and incident title
What was detected and on which system
Current status and what your team is doing
Expected next update time

Seliq drafts the notification the moment an incident is created at high or critical severity. Your analyst reviews and sends (or sets up auto-send for certain severity levels).

Incident update

Sent when significant new information is added to an incident. Answers: “Here’s what changed since our last message.”

New findings or correlated events
Actions taken (e.g. host isolated, credentials reset)
Revised severity if applicable
Revised ETA for resolution

Post-Incident Report (PIR)

Sent when an incident is closed. A full written account of the event, your response, and the recommended prevention steps. Answers: “Here’s exactly what happened, what we did, and what we’re recommending.”

PIRs are generated from the incident timeline, notes, and evidence. They follow a standard template but can be customised per client.

Customising report templates

Each workspace has a report template for each report type. Templates support:

Custom header/footer — your logo, your client’s name, and a cover page
Section toggling — show or hide specific sections (e.g. hide the technical evidence section for executive-level reports)
Tone selector — Technical, Executive, or Concise
Custom sign-off — your analyst’s name, title, and contact details

Template changes apply to all future reports for that workspace. You can have different templates per workspace (i.e. different templates for different clients).

Delivery

Seliq delivers reports via:

Email — send directly from Seliq using your own sending domain (requires DNS configuration) or the Seliq default domain
Client Portal — clients with portal access can view all their reports, filtered by date and incident

Approval workflow

By default, all client-facing reports require analyst approval before sending. You can configure per-workspace:

Manual approval (default) — analyst reviews draft and clicks Send
Auto-send — reports are sent automatically for specific report types and severity levels
Two-person approval — requires a second analyst to approve before sending (recommended for high-value or high-risk clients)