Follow claims to reports, source records and executable checks. Public capture analysis, controlled labs, private engineering summaries and browser demonstrations have different evidence boundaries.
See what the case actually demonstrates.
Inspect reports, fixtures, code or screenshots.
Understand the work that remains unverified.
The recorded-capture case has 23 focused tests; the four controlled Python exercises have 76. Tests check documented behavior and evidence joins, not production security efficacy.
What the evidence supports: Six rule/context findings from 25,993 host records and 1,121 packets, with explicit process GUID, session, clock and transport-tuple joins.
What it does not prove: Independent analysis of OTRF’s emulation, not an original owner-operated capture or production incident. Legitimate administration remains a competing explanation; cracking and exfiltration are unproven.
What the evidence supports: The first 64-event SPL search matched 3/5 expected findings; after an inclusive 600-second correction, a saved native Splunk dashboard screenshot showed all 5/5 expected findings.
What it does not prove: This October screenshot alone cannot establish indexed ingestion or native scheduled-alert provenance. It does not measure production detection accuracy or show the full query and job ID.
What the evidence supports: A separately executed controlled run matched 70 indexed source-equal authentication events, all five original expected findings, and one native scheduled alert with its exact replay result captured before the temporary schedule was disabled.
What it does not prove: The inputs were synthetic, the private native responses are not independently attested, and the newer run still lacks public screenshots. The existing local authenticated CLI—not the separate HTTPS token verifier—was used. No real incident or production accuracy is claimed.
What the evidence supports: Rule-based review separates two command-line candidates from benign controls in a fixed Windows process-creation exercise.
What it does not prove: Synthetic telemetry; no live endpoint compromise or production EDR validation.
What the evidence supports: A 20-frame generated PCAP supports two DNS/HTTP rule-candidate findings with source-attributed case evidence.
What it does not prove: Traffic is generated, not captured from a real incident; Wireshark GUI validation is not claimed.
What the evidence supports: Four deliberate HTTP weaknesses stop matching the same checks following remediation of a controlled localhost fixture.
What it does not prove: Educational loopback-only exercise; not a scan of a third-party application.
The case studies explain transferable engineering practices. The private repositories, internal records and runtime evidence are not published or independently validated here.
What the evidence supports: Reliability engineering around preserved baselines, scoped regression checks, audit trails and authorized execution boundaries.
What it does not prove: CR implementation and internal tests are private. The linked browser demonstration is independently authored, not a CR engine.
What the evidence supports: Evidence provenance, visible disagreement, attribution controls and separating research conclusions from authority to act.
What it does not prove: RAI implementation and internal evaluation are private; public browser examples do not verify semantic truth or autonomous reliability.
Try the 599 versus 600-second authentication boundary, inspect hold decisions for omitted and mismatched evidence, and download the actual browser-computed receipt.
What the evidence supports: Two independent public teaching engines compute authentication replay results and source-coverage decisions, with negative controls and a downloadable run receipt.
What it does not prove: Browser-generated receipts are not cryptographic attestations. These demonstrations do not execute private CR/RAI or Splunk.
From the public source repository, run these checks locally. No Splunk connection, production endpoint, paid service or private project access is required.
python scripts/build_browser_fixture.py --check
node scripts/test_browser_engine.cjs
python -m unittest discover -s projects/01-authentication-detection -p 'test_*.py'
python -m unittest discover -s projects/02-windows-process-triage -p 'test_*.py'
python -m unittest discover -s projects/03-network-pcap -p 'test_*.py'
python -m unittest discover -s projects/04-local-vulnerability-assessment -p 'test_*.py'Scope: Successful public tests do not independently establish credential validity, work history, production security performance, or private CR/RAI execution. Source screenshots and their documented limits are distinct from recreated visuals.