KK-ShieldEnterprise · Sentinel
Docsv5.0.0

FORENSIC INTERCHANGE

KFIF keeps evidence and context together.

Kelibatmu Forensic Interchange Format 0.1 is K-Shield’s documented JSON representation. It is not an industry standard.

Web Operations Console · sanitized

What KFIF carries

  • findings and evidence
  • provenance and acquisition method
  • canonical target, transport, and perspective
  • inventory and risk context
  • integrity hashes, lineage, and replay references

Integrity is not identity

SHA-256 detects changes. Authenticity additionally needs a valid detached Ed25519 or RSA-PSS-SHA256 signature and trusted public key. Unsigned KFIF is not_signed.

Verification

python scanner.py report verify report.kfif.json
python scanner.py report verify-signature --report report.kfif.json --signature report.sig.json --public-key signing-public.pem