okhp3-post-breach-forensics

Topics in the source

• okhp3-post-breach-forensics
• Outcome
• Scope
• Inputs
• Procedure
• Validation loop
• Safety and failure boundaries
• Output contract

OverKill Hill P³ · overkillhill.com · github.com/OKHP3 Produce a defensible incident narrative that distinguishes facts, hypotheses, gaps, and corrective actions. Work only with the approved evidence, environment, and decision boundary named in the inputs. This package produces analytical or lab evidence; it does not grant authority, expand scope, or prove live-system security. Incident record, preserved logs, decision trail, inventory snapshots, approved forensic access, timeline, and incident owner. 1. Confirm scope, authority, owner, evidence status, and stop conditions. 2. Confirm authority and preservation scope 3. build a normalized timeline 3. trace identities, tools, permissions, calls, and boundaries without altering originals 3. separate evidence from inference 3. assign corrective actions. Compare the result with the stated scope, expected output, and evidence tier. Reconcile contradictions, missing prerequisites, and benign explanations before a conclusion. Record the reviewer, timestamp, limitations, and next authorized action; return blocked or defer-for-evidence when needed. Investigate a suspected agentic security incident and convert evidence into validated defensi

This is an excerpt. Refer to the complete source and its current requirements.