Document completed supplemental data validation and coverage limits
This commit is contained in:
1 parent
b4fd5fb6ff
commit
b709b311d0
1 file changed
+14
@@ -229,3 +229,17 @@ inventory entries matched a freshly prepared copy. It processed 1,117,532 record
|
||||
two missing-file review events, no supplemental IOC or file-hash hit. Status
|
||||
remains partial: ten binary-file read stops and 106,842 decoding failures, with
|
||||
no matching or inventory errors. These counts are not compromise indicators.
|
||||
|
||||
|
||||
A separate supplemental log recheck completed over 4,604,594 records in 1,711
|
||||
files using four triage-library workers. Original and working-copy SHA-256
|
||||
inventories matched. No supplemental rule, indicator or original-file hash hit
|
||||
was found. Coverage remains partial: 788 text read stops (776 database files,
|
||||
12 binary login/scoreboard files) and 1,338,016 decoding failures. No matching
|
||||
errors occurred. This focused recheck did not repeat unchanged public rules or
|
||||
perform another correlation pass. A failed earlier database run was excluded.
|
||||
|
||||
The streaming recheck agreed with the standard engine on raw, Base64, URL-encoded,
|
||||
process-list and benign fixtures. Saved process/permission collection records
|
||||
were reviewed separately. Private rules, indicators, records and evidence remain
|
||||
outside the public repository. These results do not establish absence of compromise.
|
||||
Reference in new issue
Block a user