Documentation / SwarmHack

Output Artifacts & OCSF

Output Artifacts

Default destination: ./reports/. Mission id format: mission-{YYYYMMDD}-{HHMMSS}-{shortid} (8-char hex UUID suffix to deconflict same-second runs).

Artifact matrix

| Artifact | Filename | Format | When produced |

| --- | --- | --- | --- |

| OCSF mission JSON | mission-{ts}-{id}.json | OCSF 1.1.0 Vulnerability Finding (class_uid=2001, category_uid=2) | Always. |

| HTML attack-path graph | mission-{ts}-{id}-attack-path.html | D3.js single-file HTML | Always when chain produced ≥ 1 finding. |

| Graphviz attack graph | mission-{ts}-{id}-attack-path.dot | DOT | Alongside the HTML. |

| SSE upsell Markdown | mission-{ts}-{id}.sse.md | Markdown (8 sections) | --report sse listed. |

| Per-target copies | reports/per-target/mission-{ts}-{id}.{json,html,dot} | Same formats | Multi-target campaign. |

| SSE delta Markdown | reports/mission-delta-{ISO}.sse-delta.md | Markdown | swarmhack scorecard --report sse-delta. |

| Structured logs | ./logs/{session-uuid}.jsonl (rotated, gzipped) | JSON Lines | When file logging enabled (default). |

OCSF report shape

The OCSF emitter pins class_uid and category_uid to the Vulnerability Finding class:

  • OCSF_CLASS_UID = 2001
  • OCSF_CATEGORY_UID = 2
  • OCSF_CLASS_NAME = "Vulnerability Finding"

The strict validator hard-errors when a finding emits any other class_uid (e.g. the legacy 6001 Application Activity).

Per-finding fields

  • Severity + risk score + confidence
  • CWE
  • MITRE ATT&CK techniques
  • OCSF compliance mappings: PCI-DSS, OWASP Top 10, NIST CSF 2.0, SOC2, HIPAA, ISO 27001, DORA, NIS2
  • A crown_jewels[] array with sanitised extracted secrets

SSE upsell report sections

| § | Title | Purpose |

| --- | --- | --- |

| 1 | Executive summary | Top-line counts + headline finding. |

| 2 | Successful exploit paths | Per-finding "what worked" bullets. |

| 3 | Blocked exploit paths (the win column) | Confirmed blocks — proof the existing SSE stack works. |

| 4 | Missing controls | Confirmed exposures with no SSE coverage today. |

| 5 | License / Feature mapping | SKU table with priority (P0/P1/P2), capability_kind, scope rollup, remediation. |

| 6 | Evidence appendix | Pointers to OCSF JSON + HTML attack path. |

| 7 | Prioritized upsell plan | SE-ready upsell sequence. |

| 8 | Authorization footer | Authz-doc path + tester name from the loaded doc. |