Skip to content

Intel Codex - v2.1.0

Latest
Latest

Choose a tag to compare

View all tags
@gl0bal01 gl0bal01 released this 08 Nov 16:58
· 2 commits to main since this release
v2.1.0
This tag was signed with the committer’s verified signature.
gl0bal01 gl0bal01
SSH Key Fingerprint: nsp9/dS9a3LM1Zk07Oa/3BauiVxsRFFMLE9MkZVDxjM
Verified
Learn about vigilant mode.
71f5b55
This commit was signed with the committer’s verified signature.
gl0bal01 gl0bal01
SSH Key Fingerprint: nsp9/dS9a3LM1Zk07Oa/3BauiVxsRFFMLE9MkZVDxjM
Verified
Learn about vigilant mode.

🧠 Intel Codex (v2.1.0)

Intel Codex is an operational manual for digital investigators, security analysts, OSINT practitioners, and CTF players, maintained as an Obsidian vault with mirrored Docusaurus publication.

This release is about accuracy: nearly every SOP was re-checked claim by claim against primary sources, and the vault now publishes that record.

📊 By the Numbers

42 SOPs (up from 41 at v2.0.0) | over 4,200 [verify] source checks (up from about 870) | 40 of 42 SOPs re-checked against primary sources since October 2026

Domain v2.0.0 v2.1.0 Delta
Investigations / Platforms 8 8 —
Investigations / Techniques 12 12 —
Security / Analysis 10 11 +ai-vulnerability-evasion-guide
Security / Pentesting 11 11 —

✅ Published Verification Record

  • Verification-Status.md — generated per-SOP table: number of source checks, oldest check, age, and status (current / due soon / overdue). It reports when claims were last checked against their sources, not that a procedure was lab-tested.
  • Yearly re-check cadence — a SOP stays current for 335 days, measured from its oldest marker.
  • One [verify YYYY-MM-DD] marker = one claim (command flag, tool default, statute, vendor behaviour) checked against the vendor's docs or repo, the standard's text, or the official dataset on that date.

🔍 Source Re-Checks

Re-checked against primary sources (Oct–Nov 2026), with a "what's new" pass for field changes since each SOP's last update:

  • Legal & OPSEC core — sop-legal-ethics, sop-opsec-plan (NIS2 does not criminalise unauthorised access; US AI executive orders, EU CRA reporting deadlines and radio-spectrum rules consolidated in legal-ethics)
  • Investigations — all 8 platform playbooks and all 12 technique SOPs (investigation core, blockchain, mixer tracing, dark web, AML)
  • Security / Analysis — forensics, cloud forensics, SaaS log forensics, email/BEC forensics, hash methods, reverse engineering, vulnerability research (exploitation material consolidated), cryptography (NIST IR 8547, X25519MLKEM768), smart-contract audit, malware analysis, AI vulnerability & evasion
  • Security / Pentesting — Linux, Active Directory, cloud, container/Kubernetes, wireless/RF, bug bounty, mobile, detection evasion
  • Frameworks — ATT&CK v20 remap (incl. the v19 Defense Evasion split into Stealth TA0005 / Defense Impairment TA0112), MITRE ATLAS v2026.10 IDs, OWASP LLM Top 10 2026, OWASP MASTG v2 / MASWE v1

Still on April 2026 markers: sop-web-application-security and sop-firmware-reverse-engineering (next in the queue).

🛡️ Method and Facts

Exploitation and bypass sections now keep explanations, vulnerable-pattern snippets, detection, mitigations and version facts. Ready-to-use payloads, shellcode, ROP chains, jailbreak prompts and bypass scripts were removed and replaced by the test category, a pass/fail criterion, a stop rule and a maintained tool (garak, promptfoo, PyRIT, objection, MASTG techniques). Proof-of-concept steps use harmless canaries.

🤖 AI Vulnerability & Evasion (v3.2)

  • sop-ai-vulnerability-evasion rebuilt as an operational runbook: Quick Mode, rules-of-engagement appendix, garak / promptfoo / PyRIT configs, trial counts with Wilson confidence intervals, severity matrix, agent action controls, supply-chain checks, guardrail evaluation, worked RAG-chatbot and coding-agent engagements
  • Arcanum Prompt Injection Taxonomy (v1.6.1, CC BY 4.0) as a secondary label beside ATLAS / OWASP
  • New companion sop-ai-vulnerability-evasion-guide — a two-page field guide

📐 Structural & Quality Improvements

  • Quick Mode checklists added to five operational SOPs
  • README rewritten as a landing page with a generated SOP count and a hero image; title/description front matter on README pages
  • Internal links repaired for targets the site builds publish
  • CTF guides and sample writeups verified and linked to the newer SOPs
  • AML — C4ADS Horizons added (access-gated)

🛠️ Tooling & CI

  • .github/workflows/vault-check.yml — runs tools/check-vault.sh and fails if the generated counts or Verification-Status.md are stale
  • tools/ci-local.sh + .githooks/pre-push — local mirror of CI, run before every push
  • New per-SOP lints — marker_lint.py (marker placement), code_block_check.py (bash -n, Python compile, untagged fences), anchor_check.py (in-file anchors), wikianchor_check.py ([[file#heading]] anchors), attack_check.py (ATT&CK IDs against the official STIX bundle)
  • tools/list-stale-sops.sh, tools/verification-cadence.sh — shared re-check cadence across the vault scripts
  • check-vault.sh now requires a real sop-legal-ethics link in every SOP and checks anchors

🔧 Build & Publishing

  • mirror.yml still mirrors main to Codeberg
  • The lecodex rebuild dispatch was added in May and removed in November

🎯 Compatibility

  • Obsidian v1.0+ — vault is the source of truth (wikilinks, YAML front matter, Dataview in Investigations-Index.md only)
  • Docusaurus — mirrored via the out-of-tree vault-sync plugin; index.md and README.md counts verified by tools/check-vault.sh
  • GitHub — README renders on the repository page; Cases/ uses Markdown relative paths

Full changelog: v2.0.0...v2.1.0

Assets 2
Loading