mid-engagement-ir-detection

Mid-engagement IR detection tracks how a target's defenses respond to active red-team testing by capturing baseline conditions and logging state_changes deltas to quantify real-time SOC responses.

Track SOC responses by maintaining baseline data in engagement_log/baseline.json and recording test activity in journal.jsonl to generate dual findings of pre- and post-mitigation conditions.

Log state changes by capturing a baseline fingerprint first, then accumulating deltas in engagement_log/state_changes.jsonl to build a sequential evidence record of mid-engagement mitigation observations.

Yes, you can generate dual-finding deliverables by pairing original vulnerability findings with mid-engagement mitigation observations, supporting robust client reporting of both pre- and post-mitigation states.

Apply mid-engagement IR detection when monitoring an ongoing engagement and when baselines shift, patches appear, or attacker activity changes during active testing to capture real-time defense responses.

You need engagement_log/baseline.json, engagement_log/journal.jsonl, and engagement_log/state_changes.jsonl in use to detect and record mid-engagement changes and build evidence sequences.