A county blue team requests an IOC-style list of all pivot ports and protocols used during the engagement. What should already be true of the tester's working notes?
Select an answer to reveal the explanation.
Short Explanation
If you opened doors for yourself, write down which doors. Pivot ports and protocols are breadcrumbs the blue team needs to tell your traffic from a real break-in. Good notes make cleanup and correlation painless.
Full Explanation
Authorized engagements often require cooperation with defenders, including sharing indicators for tester-created tunnels and listeners. Accurate contemporaneous notes of ports, protocols, and involved hosts enable detection tuning and post-engagement cleanup. Omitting that detail increases false-positive risk and operational confusion. Sharing engagement IOCs with the client blue team does not void authorization when done under the agreed process.