mid-engagement-ir-detection

You document mid-engagement state changes by capturing baseline target behavior and logging subsequent test results in an append-only journal, then diffing the state to generate formal findings. This preserves both pre-change and post-change observations for reporting.

Mid-engagement IR detection captures real-time SOC patches and attacker activity during active red-team testing. It is needed when target environments apply mitigations or credential locks mid-test, requiring you to record both pre- and post-change security states.

Capture two-state findings by maintaining a baseline state file and an append-only event log. When a state change occurs, run a diff against the baseline and use the provided finding templates to document the pre- and post-change evidence.

Tracking real-time security state changes requires maintaining a baseline.json for initial state, a journal.jsonl for append-only test result logging, and a state_changes.jsonl for diffing and recording formal findings.

If your engagement lacks active SOC mitigations or real-time state changes, this workflow is less applicable. It is specifically designed for dynamic environments where patches and credential locks occur mid-test, enabling two-state evidence capture.

You maintain an append-only journal by logging every test result with full context into the journal.jsonl file throughout the engagement. This ensures an immutable record of observations for later state-change diffing and reporting.