- Add validated mitre_attack frontmatter to all 754 skills (286 distinct
techniques), verified against MITRE ATT&CK v19.1 via the official
mitreattack-python library: 0 revoked, deprecated, or invalid IDs
- Curate precise per-skill technique IDs for forensics, malware-analysis,
threat-intel, and red-team skills (e.g. DCSync -> T1003.006,
Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003)
- Reconcile v19.1 tactic restructuring: Defense Evasion split into
Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.*
family and T1070.001/.002 remapped to active equivalents (T1685.*)
- Normalize word-split tags across 35 skills (remove filename-derived
stopword tags, add semantic cybersecurity tags)
- Add api-reference.md for 3 skills that were missing it
- Update README ATT&CK section with accurate v19.1 tactic distribution
Build an append-only log integrity chain using SHA-256 hash chaining for tamper detection. Each log entry is hashed with the previous entry's hash to create a blockchain-like structure where modifying any entry invalidates all subsequent hashes. Implements log ingestion, chain verification, tamper detection with pinpoint identification, and periodic checkpoint anchoring to external timestamping services.
cybersecurity
security-operations
log-integrity
tamper-detection
hash-chaining
sha-256
audit-logging
security-operations
1.0
mahipal
Apache-2.0
DE.CM-01
RS.MA-01
GV.OV-01
DE.AE-02
T1078
T1190
T1059
Implementing Log Integrity with Blockchain
When to Use
When deploying or configuring implementing log integrity with blockchain capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Instructions
Install dependencies: pip install requests
Ingest log entries from syslog, JSON, or plain text files.
For each entry, compute SHA-256 hash of: previous_hash + timestamp + log_content.
Store the chain as a JSON ledger with entry index, timestamp, content hash, previous hash, and chain hash.
Verify chain integrity by recomputing all hashes and detecting breaks.
Optionally anchor checkpoint hashes to an external timestamping service.
mukul975
cb8d79e068