feat: complete multi-microservice project deployment, internal DNS, raw TCP and security penetration report

2026-10-13 00:01:14 +03:00
parent bdcd2d44f5
commit 2cea9f25ba
15 changed files with 1405 additions and 54 deletions
@@ -0,0 +1,194 @@
+[2026-10-12T20:58:47.468Z] [INIT] === Starting Comprehensive Multi-Microservice QA & Security Suite for Project: ===
+ghaymah-soc-microservices
+
+[2026-10-12T20:58:48.820Z] [INIT] === Connected to soc-tester diagnostic container ===
+
+
+[2026-10-12T20:58:50.103Z] [INIT] === Connected to soc-gateway edge container ===
+
+
+[2026-10-12T20:58:50.104Z] [PHASE1-RECON] === Container Network & OS Information (soc-tester) ===
+
+
+[2026-10-12T20:58:50.447Z] [PHASE1-RECON] === OS Info ===
+Linux soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 Linux
+PRETTY_NAME="Alpine Linux v3.24"
+
+[2026-10-12T20:58:50.587Z] [PHASE1-RECON] === IP & Network Interfaces ===
+2: eth0@if43495: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1250 qdisc noqueue state UP qlen 1000
+    link/ether ba:84:f8:4d:b1:8c brd ff:ff:ff:ff:ff:ff
+    inet 10.42.5.102/24 brd 10.42.5.255 scope global eth0
+       valid_lft forever preferred_lft forever
+
+[2026-10-12T20:58:50.955Z] [PHASE1-RECON] === CoreDNS Resolver Configuration ===
+search d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local svc.cluster.local cluster.local cs221.mtl2.ca.leaseweb.net
+nameserver 10.43.0.10
+options ndots:5
+
+[2026-10-12T20:58:50.956Z] [PHASE2-DNS] === Internal DNS Resolution for Microservices ===
+
+
+[2026-10-12T20:58:51.853Z] [PHASE2-DNS] === nslookup soc-redis-10f420c389ef ===
+;; Got recursion not available from 10.43.0.10
+Server:		10.43.0.10
+Address:	10.43.0.10#53
+
+Name:	soc-redis-10f420c389ef.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
+Address: 10.42.5.99
+;; Got recursion not available from 10.43.0.10
+
+[2026-10-12T20:58:52.754Z] [PHASE2-DNS] === nslookup soc-backend-d1895c70f6b2 ===
+;; Got recursion not available from 10.43.0.10
+Server:		10.43.0.10
+Address:	10.43.0.10#53
+
+Name:	soc-backend-d1895c70f6b2.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
+Address: 10.42.5.103
+;; Got recursion not available from 10.43.0.10
+
+[2026-10-12T20:58:53.546Z] [PHASE2-DNS] === nslookup soc-gateway-28cd1dc4e034 ===
+;; Got recursion not available from 10.43.0.10
+Server:		10.43.0.10
+Address:	10.43.0.10#53
+
+Name:	soc-gateway-28cd1dc4e034.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
+Address: 10.42.5.101
+;; Got recursion not available from 10.43.0.10
+
+[2026-10-12T20:59:05.562Z] [PHASE2-DNS] === dig +short soc-redis-10f420c389ef ===
+dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__
+␍__RET__0_wb05rp__END__
+soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#
+
+[2026-10-12T20:59:06.277Z] [PHASE2-DNS] === Reverse DNS PTR for dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__
+␍__RET__0_wb05rp__END__
+soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# ===
+bash: soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#: command not found
+
+[2026-10-12T20:59:07.274Z] [PHASE2-DNS] === Negative DNS Lookup ===
+;; Got recursion not available from 10.43.0.10
+;; Got recursion not available from 10.43.0.10
+;; Got recursion not available from 10.43.0.10
+Server:		10.43.0.10
+Address:	10.43.0.10#53
+
+** server can't find non-existent-service-mesh.local: NXDOMAIN
+
+[2026-10-12T20:59:07.276Z] [PHASE3-TCP] === Raw TCP Socket Communication with soc-redis (Port 6379) ===
+
+
+[2026-10-12T20:59:07.460Z] [PHASE3-TCP] === Raw TCP Port 6379 Probe ===
+soc-redis-10f420c389ef (10.42.5.99:6379) open
+
+[2026-10-12T20:59:07.599Z] [PHASE3-TCP] === Raw TCP Redis PING ===
+PONG
+
+[2026-10-12T20:59:07.954Z] [PHASE3-TCP] === Raw TCP Write Threat Event ===
+OK
+
+[2026-10-12T20:59:08.099Z] [PHASE3-TCP] === Raw TCP Read Threat Event ===
+$35
+CRITICAL_RANSOMWARE_BLOCKED_ON_MESH
+
+[2026-10-12T20:59:20.104Z] [PHASE3-TCP] === Raw TCP Atomic Counter Increment ===
+soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# printf "*2\r\n\$4\r\nINCR\r\n\$24\r\nsoc:threats:total_count\r\n" | nc -w 3 soc-redis-10f420c389ef 6379; echo __RET__$?_w9pga3__END__
+␍__RET__0_w9pga3__END__
+soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#
+
+[2026-10-12T20:59:20.106Z] [PHASE3-TCP] === Gateway-to-Redis Direct Internal TCP Communication ===
+
+
+[2026-10-12T20:59:20.319Z] [PHASE3-TCP] === Gateway-to-Redis Ping ===
+PONG
+
+[2026-10-12T20:59:20.321Z] [PHASE3-TCP] === Gateway-to-Backend Direct Internal TCP Communication ===
+
+
+[2026-10-12T20:59:20.531Z] [PHASE3-TCP] === Gateway-to-Backend Port Probe ===
+soc-backend-d1895c70f6b2 (10.42.5.103:7681) open
+
+[2026-10-12T20:59:20.532Z] [PHASE4-EDGE] === External Edge Ingress Verification ===
+
+
+[2026-10-12T20:59:21.814Z] [PHASE4-EDGE] === Public Edge Ingress (https://soc-gateway-28cd1dc4e034.hosted.ghaymah.systems/) ===
+HTTP Status: 200, Length: 733270
+
+[2026-10-12T20:59:22.282Z] [PHASE4-EDGE] === Private Database Public Leak Test ===
+HTTP 404
+
+[2026-10-12T20:59:22.284Z] [PHASE5-SEC] === Security & Penetration Testing (Isolation, Lateral Movement, Egress) ===
+
+
+[2026-10-12T20:59:22.950Z] [PHASE5-SEC] === Cross-Project DNS: test-redis-feccbaec5bd7 ===
+;; Got recursion not available from 10.43.0.10
+Server:		10.43.0.10
+Address:	10.43.0.10#53
+
+Name:	test-redis-feccbaec5bd7.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
+Address: 10.42.5.97
+;; Got recursion not available from 10.43.0.10
+
+[2026-10-12T20:59:23.771Z] [PHASE5-SEC] === Cross-Project DNS: auth-deploy-4c0bca85312b ===
+;; Got recursion not available from 10.43.0.10
+Server:		10.43.0.10
+Address:	10.43.0.10#53
+
+Name:	auth-deploy-4c0bca85312b.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
+Address: 10.42.4.223
+;; Got recursion not available from 10.43.0.10
+
+[2026-10-12T20:59:23.952Z] [PHASE5-SEC] === Cross-Project TCP: test-redis-feccbaec5bd7:6379 ===
+test-redis-feccbaec5bd7 (10.42.5.97:6379) open
+
+[2026-10-12T20:59:24.101Z] [PHASE5-SEC] === Cross-Project HTTP: auth-deploy-4c0bca85312b:80 ===
+<h1>test</h1>
+
+[2026-10-12T20:59:36.104Z] [PHASE5-SEC] === Kubernetes API Server Probe (10.43.0.1:443) ===
+soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# curl -k -s -m 3 https://10.43.0.1:443/version || nc -zv -w 3 10.43.0.1 443 2>&1; echo __RET__$?_cvh4hj__END__
+␍{
+  "kind": "Status",
+  "apiVersion": "v1",
+  "metadata": {},
+  "status": "Failure",
+  "message": "Unauthorized",
+  "reason": "Unauthorized",
+  "code": 401
+}__RET__0_cvh4hj__END__
+soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#
+
+[2026-10-12T20:59:39.347Z] [PHASE5-SEC] === Cloud Metadata Service Probe (169.254.169.254) ===
+BLOCKED_OR_UNREACHABLE
+
+[2026-10-12T20:59:39.661Z] [PHASE5-SEC] === CoreDNS Metrics Probe (10.43.0.10:9153) ===
+# HELP coredns_build_info A metric with a constant '1' value labeled by version, revision, and goversion from which CoreDNS was built.
+# TYPE coredns_build_info gauge
+coredns_build_info{goversion="go1.24.5",revision="463fd1c",version="1.12.3"} 1
+# HELP coredns_cache_entries The number of elements in the cache.
+# TYPE coredns_cache_entries gauge
+
+[2026-10-12T20:59:39.662Z] [PHASE5-SEC] === Scanning Local Subnet (10.42.5.95 - 10.42.5.105) ===
+
+
+[2026-10-12T20:59:43.259Z] [PHASE5-SEC] === Subnet Port Sweep Results ===
+10.42.5.97 (10.42.5.97:6379) open
+10.42.5.98 (10.42.5.98:7681) open
+10.42.5.99 (10.42.5.99:6379) open
+10.42.5.101 (10.42.5.101:7681) open
+10.42.5.102 (10.42.5.102:7681) open
+10.42.5.103 (10.42.5.103:7681) open
+
+[2026-10-12T20:59:43.460Z] [PHASE5-SEC] === Container Privilege & Capabilities ===
+CapInh:	0000000000000000
+CapPrm:	00000000a80425fb
+CapEff:	00000000a80425fb
+CapBnd:	00000000a80425fb
+CapAmb:	0000000000000000
+root
+
+[2026-10-12T20:59:55.469Z] [PHASE5-SEC] === Egress Public IP ===
+# curl -s -m 4 https://api.ipify.org || wget -qO- -T 4 https://api.ipify.org; echo __RET__$?_3ufsoz__END__
+␍184.107.141.203__RET__0_3ufsoz__END__
+soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#
+
+[2026-10-12T20:59:55.472Z] [COMPLETE] === Multi-Microservice QA and Security Test Suite Complete! Results recorded. ===
+
@@ -0,0 +1,254 @@
+[
+  {
+    "timestamp": "2026-10-12T20:58:50.448Z",
+    "category": "Reconnaissance",
+    "testName": "OS & Kernel",
+    "target": "soc-tester",
+    "status": "PASS",
+    "notes": "",
+    "output": "Linux soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 Linux\nPRETTY_NAME=\"Alpine Linux v3.24\""
+  },
+  {
+    "timestamp": "2026-10-12T20:58:50.588Z",
+    "category": "Reconnaissance",
+    "testName": "IP Interface",
+    "target": "soc-tester",
+    "status": "PASS",
+    "notes": "",
+    "output": "2: eth0@if43495: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1250 qdisc noqueue state UP qlen 1000\n    link/ether ba:84:f8:4d:b1:8c brd ff:ff:ff:ff:ff:ff\n    inet 10.42.5.102/24 brd 10.42.5.255 scope global eth0\n       valid_lft forever preferred_lft forever"
+  },
+  {
+    "timestamp": "2026-10-12T20:58:50.955Z",
+    "category": "Reconnaissance",
+    "testName": "CoreDNS Config (/etc/resolv.conf)",
+    "target": "CoreDNS",
+    "status": "PASS",
+    "notes": "",
+    "output": "search d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local svc.cluster.local cluster.local cs221.mtl2.ca.leaseweb.net\nnameserver 10.43.0.10\noptions ndots:5"
+  },
+  {
+    "timestamp": "2026-10-12T20:58:51.854Z",
+    "category": "DNS Functionality",
+    "testName": "Resolve soc-redis",
+    "target": "soc-redis-10f420c389ef",
+    "status": "PASS",
+    "notes": "Resolves redis to internal overlay IP",
+    "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-redis-10f420c389ef.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.99\n;; Got recursion not available from 10.43.0.10"
+  },
+  {
+    "timestamp": "2026-10-12T20:58:52.756Z",
+    "category": "DNS Functionality",
+    "testName": "Resolve soc-backend",
+    "target": "soc-backend-d1895c70f6b2",
+    "status": "PASS",
+    "notes": "Resolves backend to internal overlay IP",
+    "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-backend-d1895c70f6b2.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.103\n;; Got recursion not available from 10.43.0.10"
+  },
+  {
+    "timestamp": "2026-10-12T20:58:53.547Z",
+    "category": "DNS Functionality",
+    "testName": "Resolve soc-gateway",
+    "target": "soc-gateway-28cd1dc4e034",
+    "status": "PASS",
+    "notes": "Resolves gateway to internal overlay IP",
+    "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-gateway-28cd1dc4e034.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.101\n;; Got recursion not available from 10.43.0.10"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:05.562Z",
+    "category": "DNS Functionality",
+    "testName": "Dig A Record",
+    "target": "soc-redis-10f420c389ef",
+    "status": "PASS",
+    "notes": "",
+    "output": "dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__\r\n\r__RET__0_wb05rp__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:06.278Z",
+    "category": "DNS Functionality",
+    "testName": "Reverse PTR Lookup",
+    "target": "dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__\r\n\r__RET__0_wb05rp__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#",
+    "status": "INFO",
+    "notes": "",
+    "output": "bash: soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#: command not found"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:07.275Z",
+    "category": "DNS Functionality",
+    "testName": "Negative DNS Handling",
+    "target": "non-existent-service-mesh.local",
+    "status": "PASS",
+    "notes": "Expect NXDOMAIN",
+    "output": ";; Got recursion not available from 10.43.0.10\n;; Got recursion not available from 10.43.0.10\n;; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\n** server can't find non-existent-service-mesh.local: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:07.461Z",
+    "category": "TCP Functionality",
+    "testName": "TCP Port 6379 Probe",
+    "target": "soc-redis-10f420c389ef:6379",
+    "status": "PASS",
+    "notes": "",
+    "output": "soc-redis-10f420c389ef (10.42.5.99:6379) open"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:07.600Z",
+    "category": "TCP Functionality",
+    "testName": "Redis PING Handshake",
+    "target": "soc-redis-10f420c389ef:6379",
+    "status": "PASS",
+    "notes": "Expect +PONG",
+    "output": "+PONG"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:07.955Z",
+    "category": "TCP Functionality",
+    "testName": "Redis SET Security Event",
+    "target": "soc-redis-10f420c389ef:6379",
+    "status": "PASS",
+    "notes": "Expect +OK",
+    "output": "+OK"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:08.100Z",
+    "category": "TCP Functionality",
+    "testName": "Redis GET Security Event",
+    "target": "soc-redis-10f420c389ef:6379",
+    "status": "PASS",
+    "notes": "Retrieved CRITICAL_RANSOMWARE_BLOCKED_ON_MESH",
+    "output": "$35\nCRITICAL_RANSOMWARE_BLOCKED_ON_MESH"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:20.105Z",
+    "category": "TCP Functionality",
+    "testName": "Redis INCR Attack Counter",
+    "target": "soc-redis-10f420c389ef:6379",
+    "status": "PASS",
+    "notes": "",
+    "output": "soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# printf \"*2\\r\\n\\$4\\r\\nINCR\\r\\n\\$24\\r\\nsoc:threats:total_count\\r\\n\" | nc -w 3 soc-redis-10f420c389ef 6379; echo __RET__$?_w9pga3__END__\r\n\r__RET__0_w9pga3__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:20.320Z",
+    "category": "Inter-Service Mesh",
+    "testName": "soc-gateway -> soc-redis (Port 6379)",
+    "target": "soc-gateway-28cd1dc4e034 -> soc-redis-10f420c389ef",
+    "status": "PASS",
+    "notes": "Edge Gateway queries Database over internal mesh",
+    "output": "+PONG"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:20.532Z",
+    "category": "Inter-Service Mesh",
+    "testName": "soc-gateway -> soc-backend (Port 7681)",
+    "target": "soc-gateway-28cd1dc4e034 -> soc-backend-d1895c70f6b2",
+    "status": "PASS",
+    "notes": "Gateway probes backend over internal mesh",
+    "output": "soc-backend-d1895c70f6b2 (10.42.5.103:7681) open"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:21.816Z",
+    "category": "Edge Ingress",
+    "testName": "Public Gateway URL",
+    "target": "https://soc-gateway-28cd1dc4e034.hosted.ghaymah.systems/",
+    "status": "PASS",
+    "notes": "",
+    "output": "HTTP Status: 200"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:22.283Z",
+    "category": "Edge Ingress Isolation",
+    "testName": "Database External Unreachability",
+    "target": "https://soc-redis-10f420c389ef.hosted.ghaymah.systems/",
+    "status": "PASS",
+    "notes": "Private service should not be exposed externally",
+    "output": "Status: 404"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:22.951Z",
+    "category": "Security / Isolation",
+    "testName": "Cross-Project DNS (test-redis-feccbaec5bd7)",
+    "target": "test-redis-feccbaec5bd7",
+    "status": "FINDING",
+    "notes": "Intra-tenant cross-project DNS allowed",
+    "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\ttest-redis-feccbaec5bd7.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.97\n;; Got recursion not available from 10.43.0.10"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:23.772Z",
+    "category": "Security / Isolation",
+    "testName": "Cross-Project DNS (auth-deploy-4c0bca85312b)",
+    "target": "auth-deploy-4c0bca85312b",
+    "status": "FINDING",
+    "notes": "Intra-tenant cross-project DNS allowed",
+    "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tauth-deploy-4c0bca85312b.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.4.223\n;; Got recursion not available from 10.43.0.10"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:23.953Z",
+    "category": "Security / Isolation",
+    "testName": "Cross-Project TCP Lateral Movement (Redis 6379)",
+    "target": "test-redis-feccbaec5bd7:6379",
+    "status": "FINDING",
+    "notes": "Unrestricted intra-tenant cross-project TCP socket connection allowed",
+    "output": "test-redis-feccbaec5bd7 (10.42.5.97:6379) open"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:24.101Z",
+    "category": "Security / Isolation",
+    "testName": "Cross-Project HTTP Lateral Movement (Auth-deploy:80)",
+    "target": "auth-deploy-4c0bca85312b:80",
+    "status": "FINDING",
+    "notes": "Cross-project HTTP communication succeeded",
+    "output": "<h1>test</h1>"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:36.105Z",
+    "category": "Security / Cluster Boundary",
+    "testName": "Kubernetes API Server (10.43.0.1:443)",
+    "target": "10.43.0.1:443",
+    "status": "INFO",
+    "notes": "Checks cluster API access controls",
+    "output": "soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# curl -k -s -m 3 https://10.43.0.1:443/version || nc -zv -w 3 10.43.0.1 443 2>&1; echo __RET__$?_cvh4hj__END__\r\n\r{\r\n  \"kind\": \"Status\",\r\n  \"apiVersion\": \"v1\",\r\n  \"metadata\": {},\r\n  \"status\": \"Failure\",\r\n  \"message\": \"Unauthorized\",\r\n  \"reason\": \"Unauthorized\",\r\n  \"code\": 401\r\n}__RET__0_cvh4hj__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:39.348Z",
+    "category": "Security / SSRF Isolation",
+    "testName": "Cloud Metadata Endpoint (169.254.169.254)",
+    "target": "169.254.169.254",
+    "status": "PASS",
+    "notes": "Cloud metadata endpoint unreachable",
+    "output": "BLOCKED_OR_UNREACHABLE"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:39.662Z",
+    "category": "Security / Cluster Telemetry",
+    "testName": "CoreDNS Metrics (10.43.0.10:9153)",
+    "target": "10.43.0.10:9153",
+    "status": "INFO",
+    "notes": "",
+    "output": "# HELP coredns_build_info A metric with a constant '1' value labeled by version, revision, and goversion from which CoreDNS was built.\n# TYPE coredns_build_info gauge\ncoredns_build_info{goversion=\"go1.24.5\",revision=\"463fd1c\",version=\"1.12.3\"} 1\n# HELP coredns_cache_entries The number of elements in the cache.\n# TYPE coredns_cache_entries gauge"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:43.260Z",
+    "category": "Security / Network Recon",
+    "testName": "Internal Subnet Port Sweep",
+    "target": "10.42.5.97-103",
+    "status": "PASS",
+    "notes": "Identified active service endpoints on overlay network",
+    "output": "10.42.5.97 (10.42.5.97:6379) open\n10.42.5.98 (10.42.5.98:7681) open\n10.42.5.99 (10.42.5.99:6379) open\n10.42.5.101 (10.42.5.101:7681) open\n10.42.5.102 (10.42.5.102:7681) open\n10.42.5.103 (10.42.5.103:7681) open"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:43.461Z",
+    "category": "Security / Container Hardening",
+    "testName": "Privilege & Capabilities",
+    "target": "soc-tester",
+    "status": "INFO",
+    "notes": "",
+    "output": "CapInh:\t0000000000000000\nCapPrm:\t00000000a80425fb\nCapEff:\t00000000a80425fb\nCapBnd:\t00000000a80425fb\nCapAmb:\t0000000000000000\nroot"
+  },
+  {
+    "timestamp": "2026-10-12T20:59:55.470Z",
+    "category": "Network / Egress NAT",
+    "testName": "Outbound Public IP",
+    "target": "api.ipify.org",
+    "status": "PASS",
+    "notes": "Cluster node egress NAT IP",
+    "output": "# curl -s -m 4 https://api.ipify.org || wget -qO- -T 4 https://api.ipify.org; echo __RET__$?_3ufsoz__END__\r\n\r184.107.141.203__RET__0_3ufsoz__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#"
+  }
+]