52 lines
2.2 KiB
Markdown
52 lines
2.2 KiB
Markdown
# Phase 17 Summary: Production Validation
|
|
|
|
## Result
|
|
|
|
Phase 17 is closed.
|
|
|
|
## What was proven live
|
|
|
|
A real end-to-end forensic path was executed and closed on production infrastructure:
|
|
|
|
1. Windows EVTX package was exported on `SHARKON2025`.
|
|
2. The real zip package was transferred to `10.10.10.13`.
|
|
3. `aw-hayabusa accept` and `aw-hayabusa process-inbox --mode incident` were run through the standard wrapper.
|
|
4. Hayabusa generated a real report set with bounded traceability metadata.
|
|
5. The result was linked back into AW-rus case management as bounded `forensics.hayabusa` metadata.
|
|
|
|
## Live proof record
|
|
|
|
- host: `SHARKON2025`
|
|
- case id: `30`
|
|
- intake id: `20260521T125653Z_SHARKON2025-phase17-rerun3`
|
|
- package path: `/opt/hayabusa/archive/packages/SHARKON2025/20260521T125653Z_SHARKON2025-phase17-rerun3.zip`
|
|
- sha256: `e86b9abbfc1d706ac706c6c8a89509ab17023344c50880641e9175f73f1198d4`
|
|
- report dir: `/opt/hayabusa/reports/SHARKON2025/20260521T125654Z_incident_20260521T125653Z_SHARKON2025-phase17-rerun3`
|
|
- report artifacts:
|
|
- `summary.html`
|
|
- `manifest.json`
|
|
- `run.log`
|
|
- `timeline.jsonl`
|
|
- `logon-summary-successful.csv`
|
|
- `logon-summary-failed.csv`
|
|
|
|
## Production bugs found and fixed during validation
|
|
|
|
- `aw-hayabusa` treated `unzip` warning return code `1` as a hard failure for Windows-created zip archives that use backslashes as path separators.
|
|
- timeline modes were using the wrong Hayabusa config path; the wrapper must pass `rules/config`, not the rules root.
|
|
|
|
Both issues were fixed in `aw-server/hayabusa/aw-hayabusa.sh` and retested live against the same package.
|
|
|
|
## Why this closes the phase
|
|
|
|
- the path is no longer theoretical or docs-only; it was proven on a real Windows export package
|
|
- traceability from host to package to report directory is explicit
|
|
- AW-rus case linkage now stores bounded forensic metadata exactly as designed
|
|
- the remaining gaps are operational tuning items, not missing core implementation
|
|
|
|
## Tuning backlog after the live run
|
|
|
|
- keep at least one preserved sample EVTX zip for future regression reruns
|
|
- consider a self-check in `aw-hayabusa doctor` for `rules/config` completeness
|
|
- optionally persist a compact machine-readable proof manifest for future audits
|