36 lines
2.3 KiB
Markdown
36 lines
2.3 KiB
Markdown
|
# Protected incident evidence
|
||
|
|
|
||
|
|
The incident console lists linked evidence metadata without decrypting content.
|
||
|
|
Administrators and the dedicated analyst role can choose incident-response,
|
||
|
|
investigation or compliance as an access purpose and explicitly reveal a record.
|
||
|
|
`OIDC_ANALYST_GROUP` grants evidence read and incident triage without policy, device,
|
||
|
|
SIEM or session administration. It remains a server-defined role, not a permission
|
||
|
|
supplied by the browser. Operator membership takes precedence over analyst when
|
||
|
|
both are configured; administrators retain full access.
|
||
|
|
|
||
|
|
Plaintext uses textContent, never HTML, and is cleared after one minute, selection
|
||
|
|
changes, refresh, permission/identity changes, logout and page hiding. Delayed
|
||
|
|
responses cannot restore older content. Reveals are restricted to the available
|
||
|
|
records shown for the selected incident and checked against source-event identity.
|
||
|
|
Every successful plaintext response follows a durable purpose-bound access audit.
|
||
|
|
|
||
|
|
Evidence is device-reported information, not an independent truth attestation.
|
||
|
|
Incoming action, decision, host, file digest/size and supplied content digest are
|
||
|
|
compared with available source facts. Legacy events without those facts cannot
|
||
|
|
supply the same verification. Encryption authenticates the evidence row; a fully
|
||
|
|
tamper-evident source audit chain remains a separate production requirement.
|
||
|
|
|
||
|
|
Configure the external 32-byte `EVIDENCE_KEY_FILE` before enabling storage. On
|
||
|
|
Windows, startup verifies owner and read/write ACLs and rejects shared key access;
|
||
|
|
protect the file to the service identity, SYSTEM and Administrators. POSIX requires
|
||
|
|
an owner-only file. No key is exposed through the console. Key rotation, external
|
||
|
|
KMS/HSM custody and production backup/recovery remain deployment work.
|
||
|
|
|
||
|
|
Tests exercise actual encrypted storage, RBAC, audit failure, mismatched facts,
|
||
|
|
expiry/active incident hold and integrity failure. The genuine Electron console
|
||
|
|
proof covers purpose-bound reveal, literal script text and clearing, while backend
|
||
|
|
OpenTelemetry exports normalized metadata/discovery/reveal route timings.
|
||
|
|
|
||
|
|
Automatic native browser capture and centrally signed collection rules remain
|
||
|
|
open. This viewer completes the existing protected storage/API-to-analyst path;
|
||
|
|
it does not yet collect every click or confidential clipboard fragment itself.
|