Evidence still required

The eight gates below remain unverified until field testing and independent assessment. There are no buttons here to execute privileged operations or upload private reports.

Use the offline operator CLI to review requirements.

Operator commands: python tools/field_acceptance_v128.py, python tools/ebpf_preflight_v128.py --help and python tools/forensic_seal_v128.py --help.

Read-only. It never repairs, deletes, quarantines, or uploads data. Larger projects may require multiple verification processes or separate signed inventories.

Select a project to begin.

Detected inconsistencies

A clean consistency scan does not certify forensic authenticity, completeness or data quality.

For operator-run checks across projects, use python tools/integrity_v127.py --help. Results never include source content.

Parquet event archive

Parquet requires the optional PyArrow dependency on the Debian host. Files are retained and SHA-256 verified. Export never deletes local events.

Select a project and month.

Defensive incident playbook lab

No arbitrary commands, endpoint actions, network requests or automatically generated blocking rules. Results are preserved as local integrity-verifiable reports.

Select a project to begin.

Offline Known Exploited Vulnerabilities catalog

Import an authorized, locally supplied CISA-KEV-style JSON catalog. Files are hashed and preserved; origin authenticity is not confirmed by this application. CVE overlaps only identify leads for review.

No catalog selected.

SIEM collection quality

Choose a project.

Non-destructive event archive

Archived events remain in local SQLite storage. Export does not delete them.

Denmark crime-rate comparison

Import area-level aggregate JSON only. Supported category/measure codes come from the existing crime map. To protect small cells, non-synthetic counts below 5 are suppressed in comparisons. Relative colors do not identify where offenders live.

No rates loaded.

Select a project to inspect ingestion.

No local status yet.

Per-source inbox counts

Enrolled sensor freshness

Append-only queue snapshots

Recent Debian worker cycles

These are single-process observations, not HA throughput certification. The worker records bounded counters without storing raw event payloads in the metrics table.

Select a project to inspect normalized security telemetry.

Define a bounded behavioral rule

Run and verify historical analysis

No evaluation yet.

Only the newest 5,000 matching events are inspected, with up to 100 leads retained. Observed event timestamps and host identities are not independently attested.

Select a project to load findings.

No report reconciled yet.

Verification not run.

No verification run.

Enter a previously archived GeoJSON source snapshot ID. The validator checks 98 codes, geometry, file hash and metadata; it cannot certify official publisher currency.

No municipality snapshot selected.

Verification has not been run.

Locally retained queue, sensor and worker health findings. No emails or external notifications; a stopped worker requires an independent systemd watchdog. Acknowledgement does not hide an ongoing condition.

No SOC health evaluation yet.

Select and acknowledge a notice to see its transition history.

No verification run yet.

The hot event index is retained. Archives are separately hashed and may be verified at any time.

Compare two preserved source revisions without deleting older data. Results are aggregate counts, not personal records or location pins.

Choose a Denmark source and revision above, then check the archived SHA-256 hash, file structure and basic mapping/privacy flags. This does not certify publication authenticity or licensed use.

No correlation run yet.

Compare up to 5,000 stored events with current local IP, domain, and SHA-256 indicators. No network traffic or automatic alert creation.

With PyArrow installed, imported data is converted to compressed Parquet. Without it, CSV / JSONL is transparently retained as a fallback.

No asset data imported. Add a sourced asset or import a licensed GeoJSON layer. Colours identify reported status, not attack or vulnerability ratings.

No court records loaded. Court decisions are not crime incident counts.

No background CVE feed, external target scan, or automatic inventory collection.

3 · Import STIX 2.1 indicators

Only exact-match IP, domain and SHA-256 STIX patterns are supported. Imported indicators join your project's existing IOC engine and apply to subsequently ingested events.

The timeline contains only alerts and evidence explicitly linked to the selected case plus case lifecycle records.

Use Security Operations → Import events for normalized CSV/JSONL, Suricata EVE, Zeek JSON, Windows Event/Sysmon JSON exports, osquery events and systemd journal JSON exports. Import is local and initiated by you; it is not a live kernel sensor.

Event search

No request sent.

Manual requests are bounded and not added to project data automatically. Avoid entering personal or confidential data into untrusted services.

Local capabilities

Command availability does not prove that drivers, device permissions, or models are working. Ollama supports CPU or an optional GPU layer setting. Other engine runtimes determine GPU allocation themselves.

Supported execution paths

Storage directory

—

Operating system

—

Parquet / Arrow

—

DuckDB

—

HTTP binding

127.0.0.1 only

Platform account

Not required

Default outbound connections

None; user-triggered connectors / AI only

Verified local backup and restore

Historical local records are preserved by append-only database tables, but a disk failure can still erase them. Create a complete local archive, verify SHA-256 hashes, and restore into a separate empty folder with:

python tools/backup_local.py create my-backup.zip
python tools/backup_local.py verify my-backup.zip
python tools/backup_local.py encrypt my-backup.zip my-backup.ocsenc
python tools/backup_local.py decrypt my-backup.ocsenc verified-backup.zip
python tools/backup_local.py restore verified-backup.zip restored-data

Plain ZIP backups are not encrypted. Use the optional AES-256-GCM backup encryption commands documented in README before sharing or storing sensitive archives. Restore refuses to overwrite a destination folder.

Enroll an independently installed defensive sensor and create a one-time token. Windows ETW/WFP, Linux eBPF, and macOS EndpointSecurity are adapter targets, not included kernel collectors. Never put agent tokens in public scripts.

Token is shown once. Connect only a trusted local agent under your control.

Enroll a local JSONL log written by an existing Suricata, Zeek, osquery, Sysmon-export or journald-export collector. Manual polls or a separately started local background tailer. No packet interception or privileged kernel sensor is installed.

Log paths are restricted to user-approved roots. The collector needs an already working sensor and appropriate permissions.

Fetch actual STRAF11 aggregate observations from Statistics Denmark, using variable codes from the publisher's latest TABLEINFO. Or fetch authenticated municipality polygons using your Datafordeler key. Data and original revisions stay local.

Data requests require network access and correct publisher permissions. Source records must be created first.

Save an update job using the STRAF11 variables above and the selected matching crime-source record. It runs only after you start tools/official_sync.py on your own PC.

No automatic network requests from the web interface.

Explicitly hash a user-selected directory (bounded, read-only) and preserve a verified evidence manifest. This is not memory acquisition or certified forensic imaging.

No files are modified or uploaded.

Inspect audit integrity, local file permissions and explicitly outstanding certifications. No independent security approval is implied.

Safe network IPS rule preview

Generates a non-executed nftables example for a private test environment. It cannot alter the Debian firewall. Save and review the rollback plan before any manual deployment.

No policy has been applied.

Offline evidence acquisition and Danish municipality review

Forensic file/block-device copying and 98-municipality GeoJSON validation are available as operator-only CLI functions on the Debian host. They are deliberately not exposed through the web API. See docs/V120_OPERATIONS.md.

Altered queued events are quarantined before normalization. Snapshot reports are append-only and linked by local hashes; a privileged attacker controlling the database can still rewrite the chain.

Issues for review

Signed sensor batch continuity

Sequence gaps may indicate missing ledger records. This cannot prove that a compromised sensor reported all activity.

Saved assurance evidence

Choose a snapshot to verify integrity.

Independent certification remains outstanding.

This view displays metadata from previously processed relay messages. Actual transport is configured in the operator CLI with a trusted Redis service and secret stored outside project data. No Redis client is started when you open this screen.

Not a high-availability certification.

Transport and deployment boundaries

Outbound publishers do not receive a durable database acknowledgement from Redis XADD alone. Consumers acknowledge a stream item only after local SQLite staging or digest-only rejection has been committed. Restart recovery uses Redis consumer-group pending entries.

The Redis broker requires its own TLS, ACLs, backups and network restrictions. Local project UUIDs must be explicitly mapped. See docs/V118_RELAY_OPERATIONS.md. This is an optional relay transport; full distributed search, high availability and automatic failover are still not certified.

Project shards are opt-in. Stop the legacy worker before running the new worker mode. Different shard layouts are mutually exclusive. This is local multi-process coordination, not distributed SIEM or high availability.

Checking local worker state.

Upload a local JSONL excerpt (maximum 2 MiB) to check event types, timestamps and malformed records. Source event bodies are discarded after analysis. This does not validate sensor authenticity or import events into the SIEM.

No sample reviewed.

A missing sequence is rejected rather than silently skipped. Already accepted identical retries are acknowledged without duplicating SIEM events. Server-side batch hashes and receipt sequence numbers are retained; API secrets are never displayed.

Select a project to see enrolled sensors.

Windows-to-Debian test workflow

Enroll a sensor in the existing agent workbench and copy its one-time token into the Windows process environment. Export normalized local events to a JSON array, then use tools/signed_agent_v116.py sign with sequence 1, and send through your existing SSH tunnel. Retain a signed batch file after any unsuccessful delivery.

This is opt-in. It does not install kernel sensors or operate an inline firewall. The original token-protected legacy intake remains available for backward compatibility.

Deployment and assurance gates

Engineering status is not certification.

Offline memory-dump metadata review

User-supplied regular file on the Debian server only. No live memory acquisition, memory contents, credentials, or process secrets are displayed.

No file inspected.

Operator-attested DAGI 98-municipality source

Requires an existing project source snapshot with all 98 structurally valid polygons. Hash matching is not proof of publisher identity, licensing, or geographic accuracy.

No dataset attestation recorded.

Import small UTF-8 CSV/JSONL files with timestamp, summary, and optional host, category, artifact. Data stays on this Debian server. No disk or memory acquisition is performed.

No timeline selected.

Review which historical network events match a CIDR and optional port. This never installs rules, captures packets, or blocks devices.

No firewall changes can be made from this workbench.

Append-only project notes can record work and outstanding external review. This interface cannot declare a product independently certified.

All unverified acceptance requirements remain open for professional review.

Select a folder on your own PC to observe file creation, modification and deletion using permission-aware filesystem polling. Only metadata and hashes of changed small files are recorded; there is no kernel driver.

Hash linking detects ordinary record tampering but does not prevent a privileged local actor from rewriting the database and the whole chain.