Beacon Huntress: some thoughts following SEI Cyber Security Course, May 2025

[mkrause-nps]

Hi @sei-shuff and @sei-dupdyke,

Thanks for presenting BH to us. Here's a few thoughts I have after having used BH for a number of days:

• use time consistently in ISO-8601, e.g., in the interface where the user specifies the input log
• make the Swagger API link operational/functional or remove it
• use UNIX time consistently throughout the app and let user decide whether they want to convert this into any other format
• when I stood up an instance of BH, graphana didn't work - not sure why
• the page where the user specifies the data input file, I would not use the slash, e.g., /tutorial, because the slash to Unix users indicates root (if I place a file tutorial in my root, BH doesn't find it) - use something like .../tutorial or something and explain what ... should be
• relating to the Swagger API, how can I use BH on the command line, i.e., how can I integrate it with other tools in the toolchain?

If you're interested you can respond and we can exchange coordinates for a more direct communication to clarify/discuss more.

Cheers,
Mike

[sei-shuff]

Hello @mkrause-nps,

Thank you for your suggested items. I think it would be best to continue these conversations privately. Please send me a message ([email protected]) when you have the time and I can respond from there.

Thanks,
Sean