Project Dashboard

Circular progress gauges showing completed modules vs. total modules and completed instances vs. total instances, with counts and percentages. Additional quick-stats show total findings and discovered targets.

Color-coded risk distribution chart showing finding counts by severity: Critical, High, Medium, Low, and Informational.

Client name, device details, model number, software version, consultant info, and assessment date range.

Hierarchical breakdown: subdevice → interface → instance, showing which modules are complete, running, pending, skipped, or N/A for each.

Warnings if any modules were reset due to missing evidence files. Photo modules cannot be skipped — if the photo evidence is missing, the module is automatically reverted to pending.

Buttons for: Edit Project (opens wizard with current values), Export ZIP (download full project), Export JSON (structured data), Delete Project (requires typing DELETE), Reset Project (deletes output but keeps config; requires typing RESET).

Start Gearbox — Launches gearbox.py as a managed subprocess with sudo. Passes the project YAML, network interfaces for QR codes, and the output directory. Disabled when Gearbox is already running. Optionally passes Nessus credentials if set via environment variables (NESSUS_USER/NESSUS_PASS).

Kill Gearbox — Sends SIGTERM to the entire process tree. Gearbox’s signal handler runs cleanup (kills Responder, stops Nessus scans, reverts DHCP interfaces). SIGKILL fallback fires after 8 seconds if cleanup hangs. Requires confirmation.

Real-time stdout/stderr streaming via Socket.IO. Color-coded output: normal text (stdout), red (stderr), highlighted (status updates and findings). Console history is preserved in a ring buffer of 2,000 entries in memory and persisted to disk. Devices that join late receive the full buffer on connect.

Auto-scroll is enabled by default but pauses when you scroll up (scroll-lock detection). Scroll to the bottom to re-enable.

When Gearbox needs user input (photo confirmation, Nessus credentials, sudo password, module choices), it emits a __GB_PROMPT__ token. Gauntlet renders this as a modal dialog with either pre-defined option buttons (for choice prompts) or a free-text input field. Password-type prompts auto-detect keywords like “password”, “secret”, or “credential” and switch to password masking.

Any connected device can answer prompts — the first response wins. This enables distributed prompt handling across multiple team members.

Real-time sidebar showing per-module status updates as Gearbox runs. Modules transition through: pending → running → complete/skipped/na/error. Updated via Socket.IO events and polling.

View and manage the full process tree of the running Gearbox scan. Shows PID, command, and status of every subprocess. Individual subprocesses can be killed (only descendants of the gearbox root process).

Per-network-interface QR codes are displayed for mobile companion access. Scan with a phone to open the join page, which provides photo capture, prompt response, and activity monitoring. Multiple QR codes are shown when the server has multiple network interfaces (common in lab environments).

Risk Filter — dropdown with: All, Critical, High, Medium, Low, Informational, Unknown.

Search — free-text across title, description, IP, port, and tool source.

Findings are sorted by risk severity (Critical first), then alphabetically.

• Risk Override — Change the severity of any finding. The change propagates to findings.jsonl, all SQLite databases, creates an audit entry in finding_risk_changes.jsonl, and writes to risk_overrides.yaml so it survives re-runs.
• Rename — Change the finding title. Propagates to findings.jsonl, SQLite databases, and finding_name_changes.jsonl.
• Group Findings — Merge related findings into one. Originals move to deleted_findings.jsonl with a _grouped_into reference. The new finding inherits the highest risk and combines all output files.
• Delete — Soft-delete: moves to deleted_findings.jsonl (viewable in the Deleted tab).
• Mark False Positive — Moves to falsePositives.json + falsePositives.csv.
• Recover False Positive — Restores from FP list back to active findings.
• View Output File — Click to view associated evidence in a modal (text up to 5MB, PCAP parsed via dpkt, images rendered).
• Classification — Mark findings as Unconfirmed, Confirmed, or Validated.

Shows full finding metadata: title, risk level, IP address, port, description, CVE IDs, tools that produced it, commands used, output file paths, and classification status.

Table showing: IP Address, MAC Address, Hostname, OS, Discovery Source(s), Instances where seen, First Seen timestamp, and IP-level tools run (Nessus, Responder, tcpdump, tshark).

Expandable per-IP port list showing: Port, Protocol, Service, Version, Timestamp, and which specific tools ran against that port (nmap, sslscan, testssl, nuclei, ssh-audit, etc. — determined by scanning evidence file existence).

Hierarchical view mirroring the project’s physical structure. Each module shows a status badge (pending/running/complete/skipped/na). Expand any node to see its evidence files.

Upload files for any module. Content validation auto-detects the tool type and rejects mismatched uploads. Existing evidence can be replaced — the old file is archived to the project’s deleted/ directory. Clearing a module resets it to pending and archives all its evidence.

When evidence is uploaded, Gauntlet automatically parses findings from supported formats: Nessus XML, Nessus CSV, Nmap XML, sslscan, testssl (text and JSON), ssh-audit, shcheck, and nuclei JSON. Extracted findings are emitted as new_finding events and added to findings.jsonl.

Device Tool Photos — Virtual instances for device-level tool photos (one per unique interface type). Subdevice Photos — Virtual instances for FRONT, BACK, and INTERFACES views of each subdevice. These ensure comprehensive photographic documentation of the physical device.

Merged timeline of all Gearbox log entries (tool output, phase transitions, findings) and Gauntlet log entries (device joins, UI actions). Each entry shows timestamp, level, message, and source log (gearbox/gauntlet).

Gearbox-specific entries parsed from __GB_LOG__ tokens. Levels: INFO, WARNING, ERROR, FATAL, FINDING, PROMPT, ANSWER, STATUS, DONE.

Application-level events: device joins/disconnects, UI actions, tab visits. Fields: timestamp, event, session ID, IP address, user agent, tab.

Time-range filter — From/To datetime pickers at the top of the tab. Missing or unparseable values mean “no bound.”

Error-count pills — Tab header badges show the count of ERROR-level entries only (not total log count).

Real-time streaming — New entries appear via Socket.IO without page refresh.

Logs are persisted to gearbox_log.jsonl and gauntlet_log.jsonl in the project directory.

Full structured project state including all instance details, findings, subnet/port/URL structures, and module completion. Useful for programmatic ingestion or archival.

Portable archive of the entire project directory with relative paths. Streams with explicit Content-Length header (fixes Chrome ERR_INCOMPLETE_CHUNKED_ENCODING issues). Only enabled from the home page when ALL instances are marked complete.

From the home page, click Import Project to upload a Gauntlet-exported .zip. The archive is extracted into the canonical clients directory and registered in projects.json. Progress bar shows upload status.