Auditability
Audit trails, parallelism groups, and integration points
Audit Trail Files
| File | What It Records |
|---|---|
scan.log | Every event timestamped: tool launches, pauses, resumes, completions, errors, phase transitions |
scan.log.json | Machine-readable mirror of scan.log as a JSON array |
errors.log | ERROR-level entries only, for quick triage |
finding_risk_changes.jsonl | Every risk override: original level → new level, timestamp, reason |
finding_name_changes.jsonl | Every title rename: original → new, timestamp |
falsePositives.json | All findings marked as false positive, with timestamp and original data |
findings_snapshots/ | Point-in-time snapshots for before/after comparison |
meta.json | Tool identity, client, engagement metadata, schema version, Crucible version |
Per-tool .log siblings | Every third-party invocation: command, version, timing, exit code, stdout/stderr |
Parallelism Groups
Crucible enforces concurrency rules to prevent resource exhaustion and tool conflicts:
| Group | Tools | Rule |
|---|---|---|
| Exclusive | SS3, Fracture, Siphon, Forge, Aether, Aether-B, Aether-Z, Aether-U | Only one exclusive tool runs at a time. These are resource-intensive and would interfere with each other. |
| OSINT | OSift | Can run in parallel with SS3 only. OSift is mostly passive (DNS, WHOIS) and doesn't compete for the same network resources. |
| Any | Trawler, Auger, AuthProbe, Quill, Isotope, Bastion, Dredge | Unrestricted — can run alongside any other tool. Lightweight, offline, or target separate resources. |
Integration Points
| Integration | Endpoint | Description |
|---|---|---|
| Nexus Hub | GET /api/nexus-status | Unauthenticated health probe returning app name, version, hostname, scan status |
| Arbiter | GET /api/arbiter-projects | Normalized project list for enrichment pipeline |
| Nessus Import | Auto-queue | Nessus CSV/XML in output directory auto-imported |