engagement-lifecycle

Engagement Lifecycle Management

Engagement Initiation

Pre-Flight Checklist

Before starting any engagement, verify:

1. Documents exist and are valid:

   • [ ] roe.json — Rules of Engagement with scope, restrictions, contacts
   • [ ] conops.json — Concept of Operations with threat profile and kill chain phases
   • [ ] deconfliction.json — Deconfliction identifiers and procedures
   • [ ] opplan.json — Operational Plan with sequenced, acceptance-gated objectives
   • [ ] All documents cross-reference consistently

2. Infrastructure ready:

   • [ ] Docker sandbox running with required tools
   • [ ] C2 server reachable if post-exploitation is in scope: nc -z c2-sliver 31337 (gRPC port)
   • [ ] Operator config exists: /workspace/.sliver-configs/raptix.cfg
   • [ ] Output directories created (<engagement>/recon/, <engagement>/exploit/, etc.)

3. If any document is missing: Delegate to soundwave sub-agent first.

All paths below are relative to the engagement working directory (set via cd before commands run).

Engagement Types and Implications

Type	Starting Phase	Sub-Agents Used	Key Consideration
Full Scope	Planning → Recon	All (soundwave, recon, exploit, postexploit)	Longest duration, most OPSEC-sensitive
Assumed Breach	Exploitation	exploit, postexploit	Skip recon, start from provided foothold
Recon Only	Recon	recon only	No exploitation, intelligence gathering only
Objective-Based	Varies	Targeted subset	Focus on specific crown jewels

Read plan/roe.json to determine engagement type and adjust phase ordering accordingly.

Phase Transitions

Gate Checks (Go/No-Go Decisions)

Before transitioning between phases, verify the gate criteria from the workflow skill:

Planning → Recon:    roe.json + conops.json + deconfliction.json + opplan.json exist and validated
Recon → Exploit:     Attack surface identified, targets prioritized, vulns catalogued
Exploit → PostExploit: Initial foothold established, access type documented
PostExploit → Report: All OPPLAN objectives resolved (passed or blocked)

Phase Transition Protocol

1. Read current phase objectives from opplan.json
2. Check: are all current-phase objectives resolved?
3. Check: does the next phase have pending objectives?
4. Verify gate criteria (consult workflow skill for phase-specific gates)
5. If gate passes → proceed. If not → identify what's missing and address it.

Handling Cross-Phase Dependencies

Some objectives may uncover new targets or invalidate assumptions:

• New targets discovered during recon → Update plan/opplan.json with new objectives
• Exploit fails, need more recon → Return to recon phase for that specific target
• PostExploit reveals new network segments → May need additional recon/exploit cycles

Deconfliction

Blue Team Coordination

If roe.json specifies deconfliction contacts:

• Record all major actions with timestamps in timeline.jsonl only when a real event occurs
• If blue team detects and responds, note this as a data point (MTTD measurement)
• Never reveal TTPs to blue team during active engagement unless ROE requires it

Emergency Stop Procedure

If engagement must be halted:

1. Immediately stop all active sub-agent tasks
2. Document current state: which objectives in-progress, what's deployed
3. Record the halt in timeline.jsonl and update the affected OPPLAN objectives
4. Save plan/opplan.json with current status for potential resumption

Engagement Metrics

Track these throughout the engagement for the final report:

Metric	Description	Source
MTTD	Mean Time to Detect (per objective)	Blue team detection timestamps
Dwell Time	Time from foothold to detection	timeline.jsonl timestamps
Objectives Completed	Passed / Total	opplan.json status counts
Attack Path Depth	Number of hops from initial access	lateral movement log
Credential Exposure	Unique credentials captured	post-exploit/creds/

Engagement Completion

Final Reporting Checklist

When all objectives are resolved:

1. Attack Path Documentation:

   • Every hop from initial recon to final objective
   • Credentials used at each step
   • Privilege levels achieved on each host

2. Findings Synthesis:

   • Read all <engagement>/findings/FIND-*.md entries
   • Group by severity: Critical, High, Medium, Low
   • Map each finding to MITRE ATT&CK technique

3. Remediation Recommendations:

   • For each successful attack path, suggest defensive controls
   • Prioritize by: quick wins vs. strategic improvements
   • Reference where in the kill chain the control would interrupt the attack

4. Evidence Preservation:

   • All scan outputs in <engagement>/recon/
   • All exploit artifacts in <engagement>/exploit/
   • All post-exploit evidence in <engagement>/post-exploit/
   • Credential inventory (encrypted)

5. Cleanup:

   • List all artifacts deployed on target systems
   • Document persistence mechanisms that need removal
   • Verify no active implants remain (if applicable)