diff options
Diffstat (limited to 'kevlar/2026-06-29/OPERATIONS_LOG.md')
| -rw-r--r-- | kevlar/2026-06-29/OPERATIONS_LOG.md | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/kevlar/2026-06-29/OPERATIONS_LOG.md b/kevlar/2026-06-29/OPERATIONS_LOG.md new file mode 100644 index 0000000..b4c8d2f --- /dev/null +++ b/kevlar/2026-06-29/OPERATIONS_LOG.md @@ -0,0 +1,34 @@ +# Operations Log -- 2026-06-29 Weekly BP Report + +## 2026-06-29 14:53:00 -- Phase 0: Initialize +- ASNs loaded: 26 from bulletproof-asns.csv +- Run date: 2026-06-29 +- Prior run: 2026-06-20 (baseline for change detection) +- Censys credits: 10,000 -- full enrichment available +- Sponge data range: 2026-03-12 to present +- Cache dirs created: sponge/, honeylabs/, censys/, changes/, iocs/ +- Status: OK + +## 2026-06-29 14:53-14:55 -- Phase 1: Sponge Data Gathering +- Sponge `asn.p.isp.src` field not populated (DBIP enrichment absent) +- Used `source.as.number` field instead +- Top source ASNs in Sponge for last week: 209334, 396982, 14061, 211590, 201814 (none are BP ASNs) +- Our 26 BP ASNs not found as top source ASNs in the monitored sensor traffic +- Sponge data used in supplementary capacity for this report + +## 2026-06-29 14:55-15:00 -- Phase 2: Honeylabs Queries +- All 26 ASNs queried via honeylabs_asn_enrich_tool +- 8 ASNs had detectable activity (18 with zero events) +- Top ASN: AS51396 (Pfcloud) with 4,379 events from 94 IPs +- Event timelime: Jun 25 had major global spike (802K events) +- Data cached to honeylabs/ directory + +## 2026-06-29 15:00-15:05 -- Phase 3: Censys Aggregations +- Censys aggregations completed for active ASNs +- Key data: port distributions, software profiles +- Prior week baseline compared from 2026-06-20 run +- Change detection noted in narrative + +## 2026-06-29 15:05+ -- Phase 4/5: Report Composition +- Composing blog post for ai.rud.is +- Compiling IoC files |