TenguProtect · Cyber-defence Library
Part 1 · assessment and mitigation recommendations · published v1.0 · 14 October 2026

Tool and Repository preparation

G03 · reusable assessment method · Choose the smallest tested tool and resource set for the job.

Approval is specific, never inherited from the guide. Check the client, campaign, individual person/asset, method, channel, time window and risk ceiling. Deny overrides allow; absent, expired or withdrawn permission blocks the action. LOW/MED/HIGH describe proposed test impact, not permission or finding severity. Read the approval rules.

1. Select the task recipe

Start with a service step and its expected result. Choose its named Armory tool, actual worker environment and linked Repository guide/fixture; alternatives require equivalent evidence.

Output: test-case.json

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

2. Pin the resources

Record the tool version, Repository revision, precise file/resource ID, hash, configuration and approved target allowlist. A whole category is background reading, not an approved executable payload.

Output: resource-manifest.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

3. Inspect dependencies

Check runtime permissions, required hardware, provider configuration and remaining budget without exposing keys. Installed, runnable and validated-for-this-workflow are different states.

Output: control-matrix.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

4. Run a harmless fixture

Validate the selected tool on an owned benign fixture and an expected denied/clean control. Capture exit/result semantics and evidence location; block on missing capability.

Output: test-case.json

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

5. Freeze the plan

Assign the operator and reviewer; record the exact approved parameters and stop limits. A resource update requires review before reuse. Execution is a separate authorised action.

Output: resource-manifest.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

The inspected local tool notes are autogenerated. For example, Nmap and Wireshark both list overly broad prerequisites; Wifiphisher’s recorded run path differs from its resolved launcher. Do not run those lines unreviewed. Prefer the maintained official guide matched to the deployed version and verify the actual worker environment.