01 Monitoring
A timeline, not a verdict.
Processes, autostarts, accounts, network activity, sensors and firewall state are observed and joined into one timeline, so every change has a before and an after. What is recorded comes first; what responds to it comes second.
- Evidence before response
- Absence is logged as not observed, never as fixed
- Public threat feeds can only add suspicion, never clear it