mid-engagement-ir-detection

Capture baseline security-state fingerprints before testing, then continuously monitor post-change observations and log deltas in engagement_log/state_changes.jsonl to detect and document mid-engagement security-state changes.

A known vulnerability may stop reproducing mid-engagement because the client SOC deployed real-time WAF rules or code patches. Correlating baseline and post-change fingerprints distinguishes these mitigations from true vulnerability changes.

Log mid-engagement IR findings by recording observed timing shifts, response header changes, and state deltas into the structured engagement_log/state_changes.jsonl file to generate deliverable IR findings.

Yes, mid-engagement IR detection identifies client SOC patches and attacker activity by comparing baseline measurements with post-change observations during active engagements to generate structured IR findings.

Capture pre- and post-engagement fingerprints, record observed deltas in state_changes.jsonl, and generate IR findings that isolate the mitigation layer to distinguish WAF rules from true vulnerability changes.

Mid-engagement security-state monitoring should not be used without an active engagement or baseline data, as it relies on correlating pre- and post-change observations to detect real-time client mitigations or attacker activity.