diff options
Diffstat (limited to 'kevlar/2026-08-31/OPERATIONS_LOG.md')
| -rw-r--r-- | kevlar/2026-08-31/OPERATIONS_LOG.md | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/OPERATIONS_LOG.md b/kevlar/2026-08-31/OPERATIONS_LOG.md new file mode 100644 index 0000000..ab687a7 --- /dev/null +++ b/kevlar/2026-08-31/OPERATIONS_LOG.md @@ -0,0 +1,37 @@ +# Weekly BP Report -- 2026-08-31 + +Generated: 2026-08-31T10:40:00Z +Baseline: 2026-08-23 +Note: deception honeypot fleet reconfigured 2026-08-28; fleet reports (28-31 Aug) attached to run. Fleet data used for attack/IoC enrichment only. + +## 2026-08-31 11:15:00 -- Phase 1: Sponge (Arkime) +- ASNs queried: 25 +- API calls: 1 timeline + 50 stats (2/ASN) + 1 split timeline + 9 session searches +- Results cached: 52 files sponge/ +- Errors: none + +## 2026-08-31 11:20:00 -- Phase 2: Honeylabs +- ASNs queried: 25 (3 calls/ASN + per-day events pagination + IOC drilldowns) +- API calls: ~190 +- Results cached: events-*.ndjson (9 ASNs with data, 492 sampled events), top-attackers.csv, fingerprints.csv, observed-ips.json, summary.json, ioc-*.json +- Errors: initial passes hit MCP bridge truncation on large responses; fixed via per-day limit=20 + rawContent extraction. Final pass 0 errors. +- Note: ioc_lookup does not support ASN strings (returns 0); used top_attackers(asn) + per-IP IOC drilldown instead. + +## 2026-08-31 11:37:00 -- Phase 1d: BP IP session searches +- 9 IPs searched, caches in sponge/ip-sessions/ +- Cross-corroboration: 204.76.203.7 (PFCLOUD), 176.120.22.61 (PROTON66), 185.100.87.136 (FLOKINET), 147.45.71.214 (AEZA) all present in Arkime at scale + +## 2026-08-31 11:55:00 -- Phase 3: Censys +- 25 ASNs aggregated x5 fields (125 calls) + 10 IP enrichments (get_host + get_host_services) +- Cached: censys/aggregations-*.ndjson, aggregations-all.json, ip-enrichments.ndjson, fleet-correlation.csv +- Key: all 25 ASNs carry BULLETPROOF label; KPRONET zero visible services (scan-only profile) +- Errors: 1 truncated host lookup (204.76.203.49) retried OK + +## 2026-08-31 12:00:00 -- Phase 4: Change detection +- Baseline 2026-08-23. SPONGE FLEET RECONFIGURED 2026-08-28: prior-week Arkime volumes are NOT comparable (sensor coverage change). Deltas recorded but flagged as baseline break; this run becomes the new baseline. +- Cached: changes/diff-vs-prior-week.csv, changes/anomalies.csv (50 rows, volume+churn+fingerprints) + +## 2026-08-31 12:30:00 -- Phase 5+6: Report and archival +- Blog post: ai.rud.is/src/data/blog/2026-08-31-weekly-bulletproof-report.md (build passed, 32.8s) +- IoCs: 416 unique IPs, fingerprints, paths, README cached in iocs/ +- Run complete |