Skip to content

Add official Forensics Agent Runbook and update README references#406

Open
Viidhii19 wants to merge 2 commits into
VyomKulshrestha:mainfrom
Viidhii19:feat/forensics-runbook
Open

Add official Forensics Agent Runbook and update README references#406
Viidhii19 wants to merge 2 commits into
VyomKulshrestha:mainfrom
Viidhii19:feat/forensics-runbook

Conversation

@Viidhii19

Copy link
Copy Markdown
Contributor

Summary

This pull request addresses Issue #367 by creating the official "Forensics Agent Runbook" and updating the README to index developer resources for newcomers.

Closes #367


Type of change

  • Bug fix
  • New feature / enhancement
  • Documentation update
  • Tests / CI
  • Performance improvement
  • Refactor (no functional change)

Changes made

  • Added FORENSICS_RUNBOOK.md: Generated a comprehensive, production-ready administrator guide documenting the Forensics Agent, the rule-based PID translation helper in the ThreatContainmentBridge, the Tier 3/4 Security Gate confirmation loop, JSON schema, and a step-by-step SSH brute-force containment example.
  • Updated README.md: Registered the Forensics Agent in the Multi-Agent Orchestrator summary table and created a new Developer Guides & Documentation section to organize codebase entry points for newcomers.

How to test

  1. Open FORENSICS_RUNBOOK.md in your Markdown reader/GitHub and verify that formatting (headers, tables, JSON schemas, code blocks) renders correctly.
  2. Open README.md and verify that the Forensics Agent is listed in the Multi-Agent Orchestrator table and that the link to the runbook under the Developer Guides & Documentation section works.
  3. Validate that the documented commands, Pydantic field schemas, and regex-based extraction logic accurately reflect the python implementations in daemon/pilot/.

Checklist

  • I have read the CONTRIBUTING.md
  • My code follows the existing code style
  • I have added/updated tests where applicable
  • All existing tests pass (pytest for backend, npm run test for frontend)
  • I have updated documentation if needed
  • I have tested on at least one platform (Windows / macOS / Linux)

Screenshots / recordings (if UI change)

N/A


GSSoC declaration

  • This contribution is made under the GSSoC 2026 program
  • I have not plagiarised code from other repositories

@VyomKulshrestha

VyomKulshrestha commented Jun 11, 2026

Copy link
Copy Markdown
Owner

Hi @Viidhii19 thanks for adding the Forensics Runbook documentation! It is very well written and accurately explains the severity matrix and containment pipeline.

However, your local branch seems to be severely out of sync with the main branch. Because you modified an older version of README.md, this PR unintentionally deletes the documentation for the newly added Calendar Agent and completely deletes the PyTorch installation FAQ (Q8).

Could you please run git pull origin main to fetch the latest changes, and then rebase or merge them into your branch to resolve the conflicts? Once the README.md is synced up so it doesn't overwrite other contributors' work, we can get this merged!

@Viidhii19

Copy link
Copy Markdown
Contributor Author

Hi @VyomKulshrestha !
Please see if now all the issues are cleared, if not let me know.
Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Docs] Add "Forensics Agent Runbook" for System Administrators

2 participants