Evidence Tab
File-based evidence management organized by device physical structure
Evidence Tree
Hierarchical browser: Subdevice → Interface → Instance → Module. Each module shows a status badge (pending, running, complete, skipped, N/A). Click to expand and see individual files.
Evidence Operations
| Action | Description |
|---|---|
| Upload Evidence | Upload files for any module. Files validated for type and content — Nessus must be valid XML, PCAP must have correct magic bytes. When evidence is uploaded, Gauntlet auto-parses findings from supported formats. |
| Replace Evidence | Replace an existing file; old file archived to deleted/ directory |
| Clear Module | Reset module to pending status and archive all evidence — allows re-running without full reset |
| View Evidence | In-browser viewer: images inline, text preformatted, PCAP parsed with dpkt (up to 5,000 packets) |
| Set Photo Context | Set target module/instance so mobile uploads auto-file into correct directory |
Automated Evidence Parsing
When evidence files are uploaded or generated by Gearbox, Gauntlet auto-detects the tool and extracts findings:
| Format | Detection Method | Findings Extracted |
|---|---|---|
| Nessus XML (.nessus) | <NessusClientData_v2> | Plugin findings with severity, CVE, description |
| Nessus CSV | Header contains "Plugin ID" | Tabular finding data |
| Nmap XML | <nmaprun> | Open ports, services, script output |
| sslscan output | Content pattern matching | Cipher suites, certificate issues, protocol versions |
| testssl.sh output | Content pattern matching or JSON | TLS vulnerabilities, cipher issues, HSTS/HPKP |
| ssh-audit output | Content pattern matching | Weak algorithms, key exchange issues, host key problems |
| shcheck output | Content pattern matching | Missing security headers (HSTS, CSP, X-Frame-Options) |
| nuclei JSON | Valid JSON with nuclei structure | Template-matched CVEs and misconfigurations |
| PCAP (.pcap/.pcapng) | Magic bytes verification | Parsed with dpkt for packet summaries |
Special Evidence Directories
- _Tools/ — Device-level tool photos, organized by interface type
- _Photos/ — Per-subdevice photos in three views: FRONT, BACK, and INTERFACES