add: bph report iocs and daily drop helper

1 files changed, 47 insertions, 0 deletions

diff --git a/kevlar/2026-08-23/OPERATIONS_LOG.md b/kevlar/2026-08-23/OPERATIONS_LOG.md
new file mode 100644
index 0000000..383e03d
--- /dev/null
+++ b/kevlar/2026-08-23/OPERATIONS_LOG.md
@@ -0,0 +1,47 @@
+# Weekly BP Report Operations Log -- 2026-08-23
+
+## 2026-08-23 02:31:00 -- Phase 0: Initialize
+- ASNs configured: 25
+- Run dir: ~/Documents/gists/kevlar/2026-08-23/ (sponge/, honeylabs/, censys/, changes/, iocs/ created)
+- Censys credits: 10,000 remaining (reset 2026-09-13). Per-IP enrichment: ENABLED
+- Prior baseline: 2026-08-17 run found (full data set present)
+- Errors: none
+
+## 2026-08-24 02:44:00 -- Phase 1: Sponge Data Gathering
+- ASNs queried: 25 (session_stats ip/port per ASN; tag aggregation returns 0 rows in Sponge for all ASNs -- skipped, consistent with prior runs)
+- Timeline: full all-ASN hourly (split_size capped) + daily top-40 window 08-10..08-24
+- Weekly totals cached: weekly-totals-by-asn.ndjson (17 of 25 ASNs active this week)
+- API calls: ~75 session_stats/timeline; Results cached: Y
+- Data range confirmed: 2026-03-12 .. 2026-08-24
+- Errors: none
+
+## 2026-08-24 02:46:00 -- Phase 2: Honeylabs (in progress)
+- Window: 2026-08-17T00:00:00Z .. 2026-08-24T00:00:00Z
+- AS51396: 100-event sample cached; top-attackers by IP captured
+- Errors: none
+
+## 2026-08-24 03:00:00 -- Phase 3: Censys Infrastructure Profiling
+- Aggregations: 11 ASNs x (port, software, labels, cert issuer, OS); cached to censys/aggregations-AS*.ndjson
+- Per-IP enrichment: 10 hosts (get_host / get_host_services); cached to censys/ip-enrichments.ndjson
+- Fleet correlation: 8 linkage findings; censys/fleet-correlation.csv
+- Credits used this phase: ~60 of 10,000
+- Errors: none
+
+## 2026-08-24 03:02:00 -- Phase 4: Change Detection
+- Baseline: 2026-08-17 run
+- Diffs computed per ASN: new/gone IPs, new/gone ports, session volume delta
+- Output: changes/diff-vs-prior-week.csv, changes/anomalies.csv (14 flags)
+- Notable: PLI-AS +341%, FLOKINET +351%, AUROLOGIC +5380%, KPRONET +146%, PROSPERO +900%; HOSTKEY -93%, AEZA -91%
+- Errors: none
+
+## 2026-08-24 03:06:00 -- Phase 5: Narrative and Build
+- Blog post: src/data/blog/2026-08-23-weekly-bulletproof-report.md (ai.rud.is)
+- Build: npm run build -> exit 0, 0 errors, post rendered
+- Errors: none
+
+## 2026-08-24 03:07:00 -- Phase 6: IoC Archival
+- iocs/all-observed-ips.txt (151 lines), iocs/fingerprints.txt (19), iocs/c2-paths.txt (39), iocs/README.md
+- Web mirror: https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-08-23/
+- Errors: none
+
+RUN COMPLETE