1 files changed, 38 insertions, 0 deletions
diff --git a/kevlar/2026-08-17/OPERATIONS_LOG.md b/kevlar/2026-08-17/OPERATIONS_LOG.md
new file mode 100644
index 0000000..7d9f2d1
--- /dev/null
+++ b/kevlar/2026-08-17/OPERATIONS_LOG.md
@@ -0,0 +1,38 @@
+# Weekly BP Report -- 2026-08-17
+
+Operations log for the 2026-08-17 run.
+
+## 2026-08-17 -- Phase 0: Initialize
+- ASNs queried: 0
+- API calls made: 0
+- Results cached: N
+- Errors: none
+## 2026-08-17 -- Phase 1: Sponge (Arkime)
+- ASNs queried: 25
+- API calls made: 76 (73 stats + 2 timelines + 1 schema)
+- Results cached: Y
+- Errors: none
+
+## 2026-08-17 -- Phase 2: Honeylabs
+- ASNs queried: 13 (events), 5 (top attackers), 7 (per-IP IOC)
+- API calls made: 26
+- Results cached: Y
+- Errors: ioc_lookup treats "AS*" as domain type - used asn-filtered search_events/top_attackers instead
+
+## 2026-08-17 -- Phase 3: Censys
+- ASNs queried: 11 aggregations, 6 per-IP
+- API calls made: 38
+- Results cached: Y
+- Errors: aggregate endpoint transient "Query error" x6 - retry succeeded; no credit exhaustion (10,000 balance)
+
+## 2026-08-17 -- Phase 4: Change detection
+- Baseline: 2026-08-10
+- Results cached: Y
+- Anomalies: 7
+
+## 2026-08-17 -- Phase 5: Blog post
+- Wrote 2026-08-17-weekly-bulletproof-report.md
+- Build: npm run build exit=0, 0 errors, post rendered
+
+## 2026-08-17 -- Phase 6: IoC archival
+- Files written to iocs/: all-observed-ips.txt, fingerprints.txt, c2-paths.txt, README.md