77 lines
2.1 KiB
Markdown
77 lines
2.1 KiB
Markdown
# Hayabusa Artifact Workflow 2026-05-14
|
|
|
|
This document records the server-side EVTX intake and archive workflow on `<AW_SERVER_HOST>`.
|
|
|
|
## Directories
|
|
|
|
- incoming packages:
|
|
- `/opt/hayabusa/inbox/incoming`
|
|
- transient staging:
|
|
- `/opt/hayabusa/inbox/staging`
|
|
- generated reports:
|
|
- `/opt/hayabusa/reports`
|
|
- archived raw packages:
|
|
- `/opt/hayabusa/archive/packages/<HOST>/`
|
|
- archived extracted payloads:
|
|
- `/opt/hayabusa/archive/extracted/<HOST>/<INTAKE_ID>/payload/`
|
|
- state:
|
|
- `/opt/hayabusa/state/latest-intake.json`
|
|
- `/opt/hayabusa/state/latest-run`
|
|
- `/opt/hayabusa/state/latest-<HOST>`
|
|
- `/opt/hayabusa/state/logs`
|
|
|
|
## Operator flow
|
|
|
|
1. Accept a package into server inbox:
|
|
|
|
```bash
|
|
aw-hayabusa accept --package /path/to/HOST-YYYYMMDD-HHMMSS.zip --host HOST
|
|
```
|
|
|
|
2. Inspect queue:
|
|
|
|
```bash
|
|
aw-hayabusa inventory
|
|
```
|
|
|
|
3. Process queued packages:
|
|
|
|
```bash
|
|
aw-hayabusa process-inbox --mode incident
|
|
```
|
|
|
|
## Processing behavior
|
|
|
|
- the package is extracted into staging;
|
|
- host is resolved from explicit `--host`, sidecar `.host`, embedded `manifest.json`, or package name fallback;
|
|
- if EVTX payload exists, Hayabusa analysis is launched through the existing runner modes;
|
|
- regardless of success, the package and extracted payload are moved into archive;
|
|
- `intake.json` records:
|
|
- package path
|
|
- host
|
|
- intake id
|
|
- sha256
|
|
- status
|
|
- extracted payload path
|
|
- report directory
|
|
- processed timestamp
|
|
|
|
## Failure semantics
|
|
|
|
- malformed or empty packages are not lost;
|
|
- the workflow archives them with `status=failed-*`;
|
|
- the operator can inspect archived payloads without touching AW runtime storage.
|
|
|
|
## Validation evidence
|
|
|
|
- `aw-hayabusa inventory` shows queue and archive counts
|
|
- a synthetic package was accepted, archived, and recorded with:
|
|
- `status=failed-no-evtx`
|
|
- synthetic artifacts were removed after validation so production storage stayed clean
|
|
|
|
## Boundaries
|
|
|
|
- this phase does not yet move packages from Windows automatically
|
|
- this phase does not yet attach reports to AW-rus incidents or cases
|
|
- successful report generation from real EVTX remains a later validation phase
|