Evidence Gap Challenge No. 2: the proxy only kept the domain

Constructed scenario. This case is written for practice. The organisation, the people and the events in it are invented, and no real incident is being described. The techniques, artifact locations and analytic reasoning are real, but the evidence is illustrative rather than exported from a live host, so it is tidier than anything you will meet in production.

The call

Halberd Analytics is a 90-person software company. On 3 September a developer, Tomas Reiss, mentions in a stand-up that his laptop ran a build "really slowly" the week before.

Somebody checks. A package in the internal registry cache has a name one character away from a popular library, it was pulled on 26 August, and it is not in any manifest anybody can find.

What is already known

26 August, 14:02. The package was fetched and cached.

26 August, 14:02 to 14:09. The build ran. The developer remembers it being slow.

26 August onwards. Nothing obviously wrong. No alerts, no tickets.

3 September. Somebody mentions it in a stand-up.

The evidence that still exists

Source	Retained	What it holds
Internal package registry	12 months	The cached artefact itself, and the fetch record with a timestamp
Web proxy	30 days	Connection records with the domain only, no path and no query string
Firewall	90 days	Destination address, port, bytes in and out, per connection
Laptop EDR	30 days, alerts only	No alert fired. Raw telemetry retention on this tier is 7 days and has rolled
CI/CD build logs	90 days	The full build output, including every command the build ran
Entra ID sign-in logs	30 days	Interactive and non-interactive sign-ins for every developer
Git history	Permanent	Every commit, and who pushed it

The laptop was not reimaged. It is sitting in a drawer, powered off, since 3 September.

The questions

Start with what the artefact itself gives you, because it is the one piece of evidence with twelve months of retention.

List what you can establish from the cached package alone, without any log at all. Then list what you cannot.

The proxy recorded the domain and not the path.

Say precisely what that costs. Give an example of a question you could have answered with a full URL and cannot answer with a domain, and an example of a question the domain alone answers perfectly well.

The firewall kept bytes in and out per connection, for 90 days.

Explain how you would use a byte count to reason about whether anything left, and be explicit about the upper bound of what that reasoning can support.

The EDR raw telemetry has rolled, but the laptop is powered off in a drawer.

Say what you would do with the laptop, in what order, and name the one thing that is already gone because it was powered off rather than left running.

The build log is retained for 90 days and holds every command the build ran.

Say why this is probably your best source, and what specifically you would search it for. Then say what it would not show even if the package ran code.

Now the counterfactual, and the point of the exercise.

Full-URL proxy logging would have answered question 2. Estimate honestly what it costs a 90-person company to retain, and then argue either for or against turning it on. Take a position.

The business asks whether source code or credentials left the building.

Write the sentence you would put in the report. Then write the sentence you would use if, after all of the above, you genuinely cannot tell.

Notes on how this is meant to be worked

There is no answer key, and that is deliberate.

Two things separate a strong answer here. The artefact is evidence and most people reach for logs first. Question 1 is first for that reason: the thing with the longest retention in this scenario is the malicious package itself, and a great deal can be established from it before anybody opens a log.

Question 6 is the one that matters. Every evidence gap is a retention decision somebody made, usually on cost, usually without being asked. An analyst who can only say "we should log everything" has not engaged with the problem. The useful answer names a figure and takes a position.

Post your answer

Post it in the community. The two columns from Challenge No. 1 work here too: what you can prove, and what you can only say is consistent.

Sources for the constraints used above: ATT&CK T1195.001 Compromise Software Dependencies and Development Tools · ATT&CK T1552.001 Unsecured Credentials: Credentials In Files · CISA: defending against software supply chain attacks

The scenario is invented. The retention behaviours and the distinction between domain-level and full-URL proxy logging are real product behaviour and were the starting point rather than a detail added afterwards. No incident data informed this.