vulkro-sf org forensic-snapshot

Captures a point-in-time, offline-analysable forensic snapshot of an org's identity and sharing posture and writes it to a single JSON bundle.

At incident time a responder needs the live state before it changes. This command pulls that state through your authenticated sf CLI and writes one self-contained JSON file you can carry to an air-gapped analysis box.

No findings are produced here. This is a data-collection handoff, not an audit. Run logs analyze or the org-family audits against the captured data offline.

Synopsis

vulkro-sf org forensic-snapshot --target-org <alias> --output <path> [flags]

Flags

Flag	Type	Default	Description
--target-org, -o <alias>	string	(required)	Target org alias or username, as known to sf org login.
--output, -O <path>	path	(required)	Path to write the JSON snapshot bundle to.
--incident-ref <ref>	string	none	Optional incident or ticket reference recorded in the bundle for chain of custody (for example INC-4821).
--verbose, -v	flag	off	Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins).

Note that the output flag is capital -O. The lowercase -o is the alias for --target-org across the org command family.

What the bundle contains

• Users.
• Permission-set assignments.
• The permission sets themselves.
• Organization-wide defaults.
• Sharing rules.
• Recent LoginHistory.

Each section is a normalised row array, forward-compatible with new SObject columns.

Bundle shape

The bundle is schema_version-stamped so an offline reader detects a format mismatch, and it carries:

• the capture time,
• the org alias,
• the tool version,
• the optional --incident-ref ticket id for chain of custody.

Examples

# Capture a snapshot for an open incident.
vulkro-sf org forensic-snapshot \
  --target-org my-prod \
  --output ./inc-4821-snapshot.json \
  --incident-ref INC-4821

# Minimal capture.
vulkro-sf org forensic-snapshot -o my-prod -O snapshot.json

Exit codes

• 0 - snapshot written.
• 2 - error: the org could not be queried, or the output file could not be written.

This command never exits 1, because it reports no findings.

Scope and honesty

The org is read locally through your own authenticated sf CLI login, and the bundle is written to the path you name. Nothing is transmitted anywhere.

Two things to be deliberate about. First, the bundle is a point-in-time capture: it reflects the org at the moment of capture, and an attacker active before or after the capture window will not be visible in it. Second, the bundle contains identity data (usernames, permission assignments, login history), so treat the output file with the same care as any other incident artefact: it is not encrypted by this command, and where it is stored and who can read it is your decision.

The --incident-ref field records a ticket id inside the bundle for chain of custody. It is a label, not a cryptographic attestation: the bundle is not signed, and nothing here proves the file was not modified after capture.

Where to go next

• vulkro-sf org audit-trail - the Setup-change timeline the snapshot complements.
• vulkro-sf logs - offline log analysis.
• vulkro-sf org effective-perms - the live equivalent of the permission data in the bundle.