Active Deception and Threat Hunting Run Output and Evidence

This page is generated from the AWS Linux blind-trial run evidence. The terminal transcript below is the actual output rendered into the matching screencast MP4, so instructors can compare the Response HTML and video without guessing.

Run Script Output Shown In Screencast

This is the recorded terminal output for Week 10. It is intentionally verbatim so it can be checked against the MP4 screencast.

===== Phase 10: deception deployment and threat hunting =====
200
phase10-summary GET /v1/deception/fbc50d99-7b45-4568-afda-3d807bc8e3cd -> HTTP 200
[
  "data",
  "status"
]
200
phase10-deploy POST /v1/deception/fbc50d99-7b45-4568-afda-3d807bc8e3cd/deploy -> HTTP 200
[
  "data",
  "status"
]
200
phase10-deployments GET /v1/deception/fbc50d99-7b45-4568-afda-3d807bc8e3cd/deployments -> HTTP 200
[
  "data",
  "status"
]
200
phase10-sessions GET /v1/deception/fbc50d99-7b45-4568-afda-3d807bc8e3cd/sessions -> HTTP 200
[
  "data",
  "status"
]
200
phase10-analytics GET /v1/deception/fbc50d99-7b45-4568-afda-3d807bc8e3cd/analytics -> HTTP 200
[
  "data",
  "status"
]
200
phase10-teardown DELETE /v1/deception/fbc50d99-7b45-4568-afda-3d807bc8e3cd/teardown -> HTTP 200
[
  "data",
  "status"
]

Endpoint Status Output

These status files came from the same remote evidence bundle. They are listed separately so students can see which API calls completed successfully without publishing raw credential examples.

Evidence Files Produced By The Run

The response page records the actual evidence inventory and file shapes from docs/final/lab-material/run-evidence/aws-8414-20260517T152520Z/remote-evidence/phase-json. JSON values that may contain credential examples are summarized rather than published raw.