mid-engagement-ir-detection

Mid-engagement IR detection tracks real-time state changes like timing shifts, new headers, or anomalous responses against a baseline to identify active incident response mitigations. This skill correlates these deltas to differentiate between true vulnerabilities and active security controls.

Evidence hygiene and state changes are logged using structured files including engagement_log/baseline.json, engagement_log/journal.jsonl, and engagement_log/state_changes.jsonl. This append-only journaling approach ensures test results and timing deltas are captured accurately for reporting.

Baseline capture records initial engagement state metrics including timing, response size, headers, and cookies before testing begins. By maintaining this baseline, you can compare subsequent responses to detect timing shifts or anomalous responses that indicate real-time IR mitigations.

Yes, dual-findings are documented using structured IR findings templates provided by the skill. This allows you to clearly report both confirmed existing vulnerabilities and the real-time mitigations deployed by the incident response team during the active engagement.

Baseline logging must start at the very beginning of an active engagement against monitored targets. Loading this skill early ensures you capture the initial state before testing begins, which is required to accurately detect timing shifts and anomalous responses later.

No, mid-engagement state-change detection requires prior baseline logging of timing, size, headers, and cookies. Without an established baseline recorded in engagement_log/baseline.json, there is no reference point to compare subsequent deltas against to confirm incident response activity.