Case study / Security + evidence
Alfred.
Less copying.
More useful evidence.
Security reporting that connects directory events, network evidence and device context. A longer operational trial exposed weaknesses missed by short tests, so I changed the architecture, not just the report wording.
Conceptual shift-reporting workflow
Selected evidence.
Explicit checkpoints.
01 / The requirement
Explain what happened.
Show what supports it.
The team needed readable reports with traceable evidence, investigation priorities and clear uncertainty. Executives needed a concise brief; technical reviewers needed source context. Successful collection alone was not enough.
I set the operational goals, led implementation and trials, reviewed actual outputs and chose the redesign when sustained results fell short. Development combined human oversight, collaborators and AI coding tools. My responsibility was framing requirements and making delivery decisions, not accepting plausible prose as evidence.
The wider system: directory and network evidence
PowerShell tasks under a dedicated group managed service account collected selected Windows Security events every fifteen minutes and a daily read-only directory baseline. Public-key SFTP used a restricted intake identity; hashes, metadata, temporary files and receipts distinguished completed transfers. Python and Linux services handled processing. FortiAnalyzer supplied network evidence; ExtremeCloud IQ could add bounded wireless history. Reporting did not disable accounts, change passwords or automatically remediate objects.
02 / The turning point
Short tests passed.
The longer trial challenged the premise.
My account describes an approximately three-week trial after encouraging short sprints. Broad ingestion struggled with high-volume windows, pagination, source indexing, shared request capacity and catch-up work. Retained records explain these mechanisms, but do not establish an audited failure percentage for those three weeks.
An October 3 checkpoint showed the trap: two cycles completed all ten live windows but exhausted their 200-request allowance without recovering older gaps. The next exhausted that allowance and completed none of ten live attempts. The job was paused. A clean count-endpoint probe had not proved sustained full-detail ingestion.
03 / The selective architecture
Keep the evidence needed.
Query the rest with purpose.
The revised shift path captured selected web-policy, DNS-security and intrusion-prevention events. A source-restricted receiver committed raw content, normalized fields, receipt time and accounting to SQLite on a verified external volume, with no silent system-disk fallback. General traffic stayed at the source.
Reports read local receipts, then made bounded aggregate queries and targeted detail requests. Exact session, endpoint and time checks could recover MAC context; wireless history could add nearby access-point observations. Three outputs separated an operational brief, IT evidence and a category/device-address supervisor-awareness review copy. Creating that copy did not establish supervisor distribution.
Delivery is a separate state, not a side effect
The installed schedule used local calendar shifts, a ten-minute delay and daylight-saving boundary handling. Per-window directories and delivery ledgers guarded against blindly resending accepted submissions. Uncertain SMTP outcomes were held for review; missing-report checks exposed failure. Partial and empty windows carried warnings rather than an all-clear.
04 / Facts before interpretation
Use AI honestly.
Keep findings reproducible.
Earlier paths used local Qwen generation and separate assistant review through Hermes. Raw drafts still overstated password-operation outcomes and account inactivity. Deterministic evidence boundaries and guarded rendering prevented those statements becoming accepted findings.
The redesigned shift reports rendered counts, actions, classifications and limitations deterministically. An attempted password operation was not established success; a missing logon date was not proof of inactivity. A blocked detection was not a compromise, and a passed DNS-category record did not prove a successful connection.
05 / Documented validation
Three milestones.
Three different questions.
These milestones come from retained project records, not fresh tests of Alfred performed for this website.
Finite nine-hour trial: 3,766 committed events, nine emails, eighteen distinct PDFs and fifty-two inspected rendered pages. Attachment sizes and hashes were reconciled with delivery receipts; Tim confirmed all nine emails arrived. Event accounting, database integrity and planned cutoff were checked separately.
Eight-hour checkpoint and replay: 3,615 receipts occupied 12.8 MiB of allocated database and sidecar storage. The accepted on-demand replay covered October 22, 17:00:45 to October 23, 01:00:45 Eastern, end exclusive. This was not a normal calendar shift or recurring-schedule acceptance.
First scheduled partial-window report: the October 23 timer fired at 15:10. SMTP accepted three manifest-verified PDFs at 15:11:25; Tim later confirmed receipt. The report contained 2,210 records and warned that capture began partway through the shift. This was a timed-delivery milestone, not multi-day reliability proof.
What reconciliation did, and did not, establish
Fresh counts agreed with original hourly-query sums for nine indicators within the selected query scope. Source-time aggregates and receipt-time capture boundaries differ; overlapping filters cannot be added as independent totals. Count agreement does not prove event-by-event completeness. Later operating validation included sixty-seven isolated Linux tests. A separate live replay rejected incomplete detail pages until task percentage, returned count and actual data length agreed.
06 / Useful report findings
Make the next investigation clear.
The documented eight-hour replay prioritized sixteen passed Malicious Websites DNS-category records: trace the original requesting client through resolver evidence and verify intended enforcement. Resolver addresses were not treated as original endpoints.
One dropped, native-Critical IPS detection required event-time identity, service and authorized-activity checks. Thirty-one malicious/phishing-category web blocks warranted recurring source/domain review. Neither established compromise. Routine policy blocks remained a separate awareness matter, not evidence of individual browsing responsibility.
Enrichment helped selected findings, not every record
Of twenty-five representative findings queried, twenty gained time-bound MAC context and fourteen nearby wireless-history observations. This was targeted enrichment, not identity coverage for all 3,615 records. The earlier nine-hour review had exposed repeated wording, excessive continuation pages and non-blocked DNS records buried in tables; the revised reports made those investigation priorities visible.
07 / Limits + next work
Keep the boundary visible.
Keep testing beyond it.
Selective storage and bounded enrichment reduced unnecessary copying on the measured workload. They did not establish equivalent coverage, financial return, fleet-wide capacity or another successful multi-week endurance trial. Next work is sustained observation, further coverage reconciliation, retention-expiry testing and explicit recovery validation.
Identity, privacy and coverage limits
Records are not people, visits or viewed pages. A MAC association or reported account does not identify a physical user. Nearby access-point history is not exact location or continuous association; wired clients and resolvers may have none. Missing matches and denied permissions remain unresolved. Selected, incomplete coverage means no detections is not an all-clear. Company, person, host, domain and network identifiers are omitted here; no fictional reviewer names or placeholder contacts are presented as real.
Reboot, retention and evidence boundaries
A renewable approval lease and health checks bounded capture; missing renewal stopped it. The documented receiver did not automatically resume after an unexpected reboot. Three-day retention was policy, not a nine-hour expiry-test result. These are documented project findings, not a fresh audit or a production-security certification. The private source PDF is a writing input, not a downloadable attachment.
The engineering lesson