Competition Day Guide · Guide 08 · Evidence & Change Log
Evidence & Change Log Discipline
The team should be able to explain what it observed, what it changed, why the change was justified, and how the result was verified. That requires evidence and documentation during the round, not reconstructed from memory at the end.
Good notes reduce duplicate work, improve handoffs, preserve context, and make high-impact decisions easier to review.
Documentation Goal
Evidence rule
Preserve enough original state to explain the decision later
Documentation should support action, not slow the team down. Capture what matters, make the narrow change, verify it, and update the shared record while the context is still fresh.
Change log fields
Record the information the next teammate will actually need
Time
When the finding or change occurred so later events can be correlated.
System
The exact device, VM, server, switch, or platform involved.
Owner
The teammate responsible for the current state of the item.
Finding
What was observed before jumping to a conclusion.
Evidence
The command output, log source, path, configuration state, or other support for the finding.
Change
Exactly what was changed instead of simply writing that something was fixed.
Reason
Why the change was justified by the mission, evidence, and security impact.
Verification
How the team proved the security result and required functionality.
Follow-up
Unresolved questions, dependencies, rollback notes, or work another teammate must continue.
Evidence categories
Preserve the evidence that explains the system state
Identity
Services
Persistence
Network
Files
Mission
Change discipline
Keep evidence, action, and verification connected
Step 01
Observe
Write down what you actually see before deciding what it means.
Step 02
Preserve
Capture the minimum evidence needed to understand the original state later.
Step 03
Decide
Explain why a change is justified and what required function could be affected.
Step 04
Change narrowly
Modify only the account, service, rule, file, task, or setting supported by the evidence.
Step 05
Verify
Confirm both the intended security improvement and the mission function.
Step 06
Document
Update the shared record with the result, status, and follow-up.
Preservation rules
Keep evidence useful without turning documentation into the whole round
Capture the original state before changing it.
Separate observation from interpretation.
Do not rely only on terminal scrollback.
Keep timestamps and system names with important evidence.
Preserve useful file metadata before deleting or moving suspicious files.
Record high-impact changes immediately.
Keep unresolved items visible instead of guessing.
Use the shared team record for important findings.
Strong notes
Write notes that preserve the decision, not just the outcome
Too vague
Removed bad admin.
Better note
Win11-01, 10:24 - tempadmin was in local Administrators and was not listed as approved. Removed it from Administrators and verified the approved admin still had administrative access.
Too vague
Fixed SSH.
Better note
Linux-01, 10:41 - sshd is required by mission. Confirmed service and listener state, changed only the justified setting, then tested approved access.
Too vague
Changed firewall.
Better note
Server-01, 11:05 - inbound rule allowed broader access than required. Narrowed the rule and verified the required service remained reachable from the approved path.
Too vague
Suspicious task deleted.
Better note
Win11-01, 11:18 - captured task name, trigger, action, run account, and related path before removal. Verified the task was gone and required startup behavior still worked.
Weak habit vs better habit
Replace memory-based documentation with live operational records
Weak habit
Document everything at the end.
Better habit
Record high-impact findings and changes while the context is still fresh.
Weak habit
Copy huge command outputs into the log.
Better habit
Capture the evidence that explains the decision and preserve larger output separately only when useful.
Weak habit
If we fixed it, the original state no longer matters.
Better habit
Preserve enough original state to explain what changed and why.
Weak habit
Everyone can keep their own notes.
Better habit
Private notes are fine, but critical findings, changes, verification, and unresolved items belong in the shared record.
Weak habit
A screenshot proves the conclusion.
Better habit
Treat screenshots, logs, commands, and configuration state as evidence that still requires context and interpretation.
Weak habit
Verified means the command returned success.
Better habit
Verification includes both the security result and required mission functionality.
Handoff questions
A clean handoff should answer these immediately
What did you find?
What evidence supports it?
What changed?
Why was that change justified?
How was it verified?
What remains unresolved?
What should the next teammate avoid changing?
What is the next recommended action?
Documentation warning signs
These signals mean the team is losing operational context
A major change has no recorded original state.
A teammate cannot explain why a change was made.
Evidence exists only in terminal history.
The shared log contains vague entries such as fixed, done, or cleaned.
A suspicious file was deleted before its path or metadata was recorded.
A high-impact change is marked complete without verification.
Two teammates have conflicting notes about the same system.
An unresolved issue disappeared from the board without a decision.
Evidence & Change Log final checklist
Make every major decision understandable after the fact
Important findings include system and time context.
Original state is captured before high-impact changes.
Observation is separated from interpretation.
Evidence is concise but sufficient.
Important persistence or file evidence is preserved before removal.
Each major change includes a reason.
Verification covers security and mission functionality.
Shared notes are updated during the round.
Unresolved findings remain visible.
Handoffs include evidence, change, verification, and next action.
Private notes do not replace the shared team record.
The final log can explain the major decisions of the round.