Template Values for Findings

How to use template values to format findings

This markup language is under active development and will expand and change. This page will always have the most recent information.

Introducing the Values

Ghostwriter's reporting engine supports a few types of template values you can use in your findings templates to dynamically format text or insert data at reporting time.

A reference pane is included at the top of the page when editing a finding in the library or a report.

The Finding Template Value Reference

Using the Template Values

While editing a finding, the template values can be placed mid-sentence or on new lines. Certain values do have specific requirements for placement, so read on to learn the basics of each.

Type @ to initiate auto-complete! Typing @{ will display a list of all available template values.

Ghostwriter will process the values when a report is generated. The values mostly come into play when generating Word document reports (e.g. creating bulleted lists), but some do affect other report types.

To use a value, read its description for usage instructions and place the {{.VALUE}} keyword in your finding template.

The . int {{.VALUE}} is important and easy to leave out or miss.

Current Template Values

The following tables contains the current template values available for use in a finding:




This keyword will be replaced with the client's short name. The full name will be used if a short name has not been set for the client.


Start a line of text with this keyword to make it a caption. This is intended to follow a code block.

Inserting Evidence

Evidence files can be dynamically placed within a finding using the evidence file's Friendly Name value as a template value.


An evidence file has been attached with the Friendly Name set to Enigma.

An Example Evidence File Named Enigma

The Friendly Name is a more human-friendly name (compared to the file path or a timestamped file name) for referencing the evidence file. When referencing evidence in a template, enclose the Friendly Name in the curly braces, e.g. {{.Enigma}}, on a new line by itself.

Placing the Enigma Evidence in a Finding's Description

There is no need for additional lines between the template value and the preceding or subsequent lines. Adding blank lines will just create blank lines in the report output. Let the formatting handle spacing between elements.

With the evidence template value in place, Ghostwriter will drop-in the evidence file in place of the template value when the report is generated. Additionally, Ghostwriter will add a border around the image and include the evidence file's Report Caption below the image as a proper Word caption.

If the evidence is an image it will be placed as an image, centered, and set to the width of the page (6.5"). Sizing can be tweaked after the report is generated.

If the evidence is a text document of some kind (e.g. log, txt, md) it will be placed in the document using the Word template's Code Block style. Edit your template to make adjustments to the font and other formatting options.

An Example of Evidence Placement in a Finding

The first time you open your Word report you will see the Figures lack their numbers. This is caused by how Word parses the XML. The Figures are fine, but you will need to tell Word to update them to see the numbering.

Select all text in the report, right-click, and select Update Field. The Figures will now appear properly.