Evidence and Reporting

🧾 Evidence and Reporting

How WinSecHunter preserves what it found, how you prove it was not altered, and how the bundle differs from the narrative reports.

← Home · Reporting and Abuse

---

Two kinds of output

Output	Written by	Goes where	Purpose
Evidence bundle	Export-WinSecInvestigation	<OutputDirectory>/<CaseId>/	immutable facts + hashes
Reports	New-WinSecIncidentReport, New-WinSecAbuseReport, Export-WinSecIocList	<OutputDirectory>/<CaseId>-reports/	documents for humans and third parties

Reports are deliberately outside the bundle. Adding a file after export would make the manifest report an Extra file, and a verifier would be right to flag it.

Bundle anatomy

WSC-20261021-AB12CD34/
├── events.csv            flattened events (spreadsheet / SIEM)
├── events.json           flattened events (API / jq)
├── events.clixml         typed WinSecEvent objects for Import-Clixml
├── findings.json         brute-force / spraying / stuffing findings
├── sessions.csv          reconstructed logon sessions
├── coverage.csv          log completeness snapshot
├── attribution.json      PTR / geo / ASN / provider verdicts
├── timeline.csv          activity buckets
├── iocs.csv              indicators with count and first/last sighting
├── iocs.json             same, structured
├── report.html           self-contained event-centric report
├── report.md             Markdown summary
├── case.json             case metadata and notes
└── manifest.json         SHA-256 + bytes + UTC write time for every artifact above

Artifacts are written only when the corresponding input exists (for example, no findings.json when no findings were supplied).

Manifest

{
  "caseId": "WSC-20261021-AB12CD34",
  "generatedUtc": "2026-10-21T12:34:56.0000000Z",
  "collector": {
    "host": "IR-WS01",
    "user": "analyst",
    "tool": "WinSecHunter",
    "toolVersion": "2.1.0",
    "catalogVersion": "2.1.0",
    "psVersion": "7.6.6",
    "os": "Microsoft Windows 11 ..."
  },
  "hashAlgorithm": "SHA256",
  "artifacts": {
    "WSC-20261021-AB12CD34/events.csv": {
      "Sha256": "…",
      "Bytes": 123456,
      "WrittenUtc": "2026-10-21T12:34:55.0000000Z",
      "Source": "Get-WinSecEventByIp events (flattened)"
    }
  }
}

The manifest is written last and does not hash itself. Every other file is listed.

Verify integrity

$s = Test-WinSecEvidenceIntegrity -Path D:\IR\WSC-20261021-AB12CD34 -Summary
$s | Format-List BundlePath, CaseId, Artifacts, Verified, Modified, Missing, Extra, Unreadable, IsIntact

Status	Meaning	Action
OK	hash and size match	none
Modified	file exists, content or size changed	treat evidence as unreliable; re-export from source
Missing	listed in the manifest, not present	restore from a copy; do not "fix" the manifest
Extra	present in the folder, not in the manifest	added after export — remove or document it
Unreadable	exists but cannot be hashed	permissions or a lock; resolve and re-run

Extra is the check a hash list alone cannot perform: an added file breaks no recorded hash.

# machine-readable for a pipeline
Test-WinSecEvidenceIntegrity .\bundle -Json | Set-Content .\integrity.json -Encoding utf8NoBOM

# only problems
Test-WinSecEvidenceIntegrity .\bundle -ProblemsOnly | Format-Table RelativePath, Status

Reopen a case

$b = Import-WinSecCase -Path D:\IR\WSC-20261021-AB12CD34
$b.Case.CaseId
$b.Events.Count
$b.Events[0].GetType().Name        # WinSecEvent — typed, not a flat row
$b.Events | Get-WinSecIpTimeline -AsciiChart

events.json is preferred; if it is absent, events.clixml is used. -SkipEvents loads the case and the other artifacts without rehydrating events — useful for very large bundles.

The restored case keeps its evidence table, so a follow-up report references the same chain of custody.

What to hand over

Recipient	Hand over	Do not hand over
Internal case file	whole bundle + <CaseId>-reports	raw credentials
Management	executive incident report (.html or .md)	raw event dump
Auditor / court	bundle + verification output + custody notes	modified copies
ISP abuse desk	.eml (attachments included)	unrelated internal data
TIP / SIEM	iocs.stix.json or iocs.csv	account names, unless policy allows

Custody checklist

1. Export once; keep the bundle read-only afterwards.
2. Record Test-WinSecEvidenceIntegrity -Summary output and store it with the bundle.
3. Keep the original EVTX or disk image alongside the bundle when available.
4. Share copies, never the only copy.
5. If a file must be added, create a new bundle version instead of editing the old one.
6. Include the case id and UTC timestamps in every hand-off message.

Report vs bundle report

The bundle contains report.html — an event-centric document generated during export (summary cards, histogram, tables). New-WinSecIncidentReport produces a narrative report with verdict, confidence, recommendations and custody statement. They complement each other: the bundle report is raw evidence, the incident report is the story told about it.