Triage the collector run log

Objectives

The evidence collectors ran overnight and the operations review is in twenty minutes. You may escalate only the entries that compromise the evidence or the identity the collectors run as.

Everything else goes on the backlog. Raise what qualifies, worst first.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

N-1  Okta collector stopped after page 1 of 7; the quarter's evidence record is marked complete.
N-2  Run log timestamps are written in local time rather than UTC.
N-3  Collector authenticates with a departed engineer's personal API token, which still works and has admin scope.
N-4  Job duration rose from 25 to 40 minutes after the estate grew.
N-5  429 responses retried immediately, no backoff; three runs abandoned mid-collection with no alert.
N-6  Job name still references the pre-rebrand project code.
N-7  Evidence records store the payload but no run id, so a record cannot be traced to its run.
N-8  Output bucket lifecycle keeps data for 8 years; policy requires 7.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the fixture as a population, not a list

   Read each entry against one question: after this run, can the organisation still say truthfully who collected the evidence and what population it covers?

2. Step 2

   Decide what actually qualifies

   Four entries break that sentence: one identity failure, two completeness failures, and one that removes your ability to re-identify a run. The other four are operational untidiness.

   The right findings are raised

3. Step 3

   Resist the loud lines

   Local timestamps, a slower job, a stale job name and over-retention are all real backlog items. None of them changes who ran the collection or what it covered.

   Benign lines are left out

4. Step 4

   Grade the exposure, not the wording

   Rank the identity failure highest: an active admin-scoped credential belonging to a leaver is both an access finding and a contamination of every evidence record it produced.

   Then grade the completeness failures by how much they hide, silently reporting one page of seven as complete is worse than abandoning runs, and put the traceability gap last, since the data is right even if the run cannot be named.

   Severity matches the actual exposure

5. Step 5

   Rank so the first line is the one you act on

   Ask which entry you would have to disclose if the assessment started tomorrow, and lead with that.

   Ranked worst first

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.