THE FIELD GUIDE / SECURITY & RESPONSE

Evidence custody & retention

Portable records, protected archives and independent audit retention.

Mr Patchy documentation · 2 min read

Retain the record

Preserve immutable scan receipts, investigation revisions, approval records, custody events and response-monitoring results. Configure evidence retention and external immutable storage to match your organization’s operational requirements.

Export and verify

Export a reviewed response record and its checksum, retaining the digest independently. Verify the record offline with the repository’s dependency-free Python utility.

BASH

python3 tools/verify_response_record.py response.json --sha256 <independently-retained-sha256>

Export a server scanner record

Export scanner records independently of a file response, including from retained disabled/deleted server Security history. The bounded bundle contains ClamAV/YARA receipts, scanner incidents, review events and advisory plans, with missing-reference and coverage details. It does not collect file bytes, contact targets or change incident state. Retain the separate checksum through an independently trusted channel and use the same offline verifier.

BASH

python3 tools/verify_response_record.py mrpatchy-scanner-EXPORT_ID.json --sha256 TRUSTED_DIGEST

Keep the boundaries clear

Response JSON does not include every file byte, credential or target journal. Protect evidence objects, application secrets and TLS material through their own backup workflows. Hash verification detects changes relative to the trusted digest; it does not prove historical completeness.

Go deeper

Open the application reference for capability scope and technical details.

Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗