Module 03 | Produce an audit report, honestly

Create a private report folder

Raw audit and session files contain operational details. The report uses two of three intended sources because no orchestration trace exists.

Use PowerShell for JSON capture.

A professional report separates configured mechanisms, recorded events, and verified integrity.

Run in your terminal

armaraos security status
armaraos security verify

Reusable caveat

The 0.8.3 audit integrity check fails at sequence 513, so these rows are informative operational records, not tamper-evident forensic evidence.

Run in your terminal

armaraos security audit --limit 50 --json
armaraos sessions --json

Run in your terminal

armaraos orchestration list --json
armaraos orchestration export <TRACE_ID> -o run.json

The inventory is empty, so no export is attempted.

This report uses two of three intended sources. Naming the missing trace is part of the evidence.

Keep each significant post-mortem to three factual lines, and attach source files only after redaction.

Check it / ship the caveat

State the two-of-three source count and the missing trace explicitly.

Safety note

Read and redact raw audit and session exports before sharing.