IPX replay: observed-at truncates sub-second capture timestamps (ambiguous evidence ordering) #185

New issue

Open

opened 2026-09-05 04:35:16 +00:00 by mara · 0 comments

mara commented

2026-09-05 04:35:16 +00:00

Collaborator

Reviewed at commit 3b4e2da (filed against the IPX replay introduced in 6f40a44, which advances #26).

Problem
ipx-object->http-exchange (capture-replay.lisp line ~126) sets
:observed-at (unix-seconds->starintel-timestring (floor timestamp-start)).

mitmproxy writes timestamp_start as a float epoch with sub-second precision, and duration-ms (line ~127) keeps millisecond precision, so the exchange duration is more precise than the moment it happened.

Impact

Exchanges within the same second sort ambiguously in recon timelines (observed-at is the canonical ordering key).
Sub-second correlation with other evidence (visual evidence, ZAP alerts) loses ordering information that was captured.

Suggested fix
Preserve fractional seconds in observed-at (local-time:unix-to-timestamp accepts a fractional part; format with fractional-second output), or persist the raw float timestamp in the provenance plist. Deterministic ordering of captured evidence matters for recon pipelining and for the Hackpert expert layer consuming the graph.

Reviewed at commit 3b4e2da (filed against the IPX replay introduced in 6f40a44, which advances #26). **Problem** `ipx-object->http-exchange` (`capture-replay.lisp` line ~126) sets `:observed-at (unix-seconds->starintel-timestring (floor timestamp-start))`. mitmproxy writes `timestamp_start` as a float epoch with sub-second precision, and `duration-ms` (line ~127) keeps millisecond precision, so the exchange duration is more precise than the moment it happened. **Impact** - Exchanges within the same second sort ambiguously in recon timelines (observed-at is the canonical ordering key). - Sub-second correlation with other evidence (visual evidence, ZAP alerts) loses ordering information that was captured. **Suggested fix** Preserve fractional seconds in `observed-at` (local-time:unix-to-timestamp accepts a fractional part; format with fractional-second output), or persist the raw float timestamp in the provenance plist. Deterministic ordering of captured evidence matters for recon pipelining and for the Hackpert expert layer consuming the graph.

mara added the

bug

label

2026-09-05 04:35:16 +00:00