2.3 KiB
Protected incident evidence
The incident console lists linked evidence metadata without decrypting content.
Administrators and the dedicated analyst role can choose incident-response,
investigation or compliance as an access purpose and explicitly reveal a record.
OIDC_ANALYST_GROUP grants evidence read and incident triage without policy, device,
SIEM or session administration. It remains a server-defined role, not a permission
supplied by the browser. Operator membership takes precedence over analyst when
both are configured; administrators retain full access.
Plaintext uses textContent, never HTML, and is cleared after one minute, selection changes, refresh, permission/identity changes, logout and page hiding. Delayed responses cannot restore older content. Reveals are restricted to the available records shown for the selected incident and checked against source-event identity. Every successful plaintext response follows a durable purpose-bound access audit.
Evidence is device-reported information, not an independent truth attestation. Incoming action, decision, host, file digest/size and supplied content digest are compared with available source facts. Legacy events without those facts cannot supply the same verification. Encryption authenticates the evidence row; a fully tamper-evident source audit chain remains a separate production requirement.
Configure the external 32-byte EVIDENCE_KEY_FILE before enabling storage. On
Windows, startup verifies owner and read/write ACLs and rejects shared key access;
protect the file to the service identity, SYSTEM and Administrators. POSIX requires
an owner-only file. No key is exposed through the console. Key rotation, external
KMS/HSM custody and production backup/recovery remain deployment work.
Tests exercise actual encrypted storage, RBAC, audit failure, mismatched facts, expiry/active incident hold and integrity failure. The genuine Electron console proof covers purpose-bound reveal, literal script text and clearing, while backend OpenTelemetry exports normalized metadata/discovery/reveal route timings.
Automatic native browser capture and centrally signed collection rules remain open. This viewer completes the existing protected storage/API-to-analyst path; it does not yet collect every click or confidential clipboard fragment itself.