THE FIELD GUIDE / SECURITY & RESPONSE
Startup & scheduled-task awareness
Know what runs at boot, login or on a schedule—and whether it matches a verified default.
Discover jobs and effective units
Inventory system and per-user cron jobs, root/user crontabs, cron directories, anacron and queued at jobs as individual entries with source, schedule, account and command. Inspect vendor, administrator and user systemd services/timers, drop-ins, overrides, enablement links and supported generated/transient units. Show effective precedence, enabled/disabled/masked state and timer-to-service relationships.
Cover the supported execution mechanisms
The mechanism catalog includes applicable SysV init/runlevel links, rc.local, shell startup files, XDG autostart, SSH rc hooks, udev rules, loader/preload and module-load/modprobe configuration. Administrator-configured additional scope and platform-specific locations remain explicit. Discovery reads configuration as data and never sources scripts or runs discovered jobs. Inaccessible accounts, remote homes, unsupported mechanisms and collection races remain coverage gaps.
Separate package defaults from custom changes
Native package ownership and version information is combined with authenticated exact-version vendor artifacts/defaults. Distinguish verified unchanged defaults, package-owned modified configuration, generated entries with unverifiable defaults, custom/unmanaged entries and unknown origin. Track an override separately from the vendor unit and custom jobs within a package-owned file.
Explain custom and modified entries
With AI enabled and sharing authorized, assess entries at initial discovery and after meaningful change. Explain apparent purpose, trigger, execution privilege, effective command, referenced script, provenance and supporting/contradicting observations. Authorized bounded content is redacted and treated as untrusted input. Assessments bind to exact file/entry identity and evidence revisions; insufficient evidence remains unknown.
Follow change and review history
Initial discovery, recurring reconciliation and supported change triggers retain additions, modifications, deletions and baseline history. Search by mechanism, job/unit, trigger, account, state, provenance and assessment. Open stored Files and Coverage views, inspect source details and linked incidents, and record reviewed benign/false-positive decisions against the observed version. Changed evidence requires reassessment.
Keep inventory independent of AI
Inventory, provenance and deterministic change alerts continue while AI is paused or unavailable. Paused, pending, failed and stale assessments stay visible. Suspicious findings enter the broader malware investigation workflow, but a custom entry or AI suspicion alone never authorizes deletion, termination or quarantine.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗