mid-engagement-ir-detection

What problem does it solve?

It helps you turn mid-engagement changes in a target’s behavior into defensible, deliverable security findings instead of mistakenly treating recheck failures as false positives.

Core Features & Use Cases

• Pre/post state fingerprinting: Capture timing, response size, headers, cookies, and lockout indicators before active testing, then compute deltas after the session or upon first failed recheck.
• SOC-patch and control-depth interpretation: Distinguish whether behavior changes are consistent with WAF rule deployment versus code-layer fixes, using structured rechecks and variant probes.
• Operational IR evidence packaging: Convert observed state changes (including detection-induced rate limiting and concurrent attacker activity) into report-ready findings with evidence discipline and templates.
• Use Case: During an authorized red-team exercise, you confirm an SQLi and later notice response timing and headers changing; use this Skill to document both the confirmed vulnerability window and the client’s real-time mitigation behavior as separate findings.

Quick Start

Use this Skill when running an active, monitored engagement and response patterns shift during your test so the AI captures a pre-patch fingerprint, detects state changes, validates what changed with targeted rechecks, and writes an audit-grade report with a timeline.