{
  "id": "security-cyberchef-fixed-log",
  "chapter": "security",
  "title": "Base64 log decode, schema check, and audit trail",
  "synthetic": true,
  "referenceSoftware": {
    "name": "GCHQ CyberChef",
    "source": "https://gchq.github.io/CyberChef/",
    "repository": "https://github.com/gchq/CyberChef",
    "license": "Apache-2.0",
    "version": "11.5.0",
    "revision": "8cd426dd4f40f1423912d5fad91b578a86a65112"
  },
  "recipe": [
    "From Base64"
  ],
  "inputBase64": "eyJldmVudCI6ImF1dGhfZmFpbGVkIiwiaG9zdCI6ImxhYi0wMiIsInNyY19pcCI6IjIwMy4wLjExMy40MiIsInVzZXIiOiJkZW1vIiwidHJhY2UiOiJULTAwMDcifQ==",
  "outputText": "{\"event\":\"auth_failed\",\"host\":\"lab-02\",\"src_ip\":\"203.0.113.42\",\"user\":\"demo\",\"trace\":\"T-0007\"}",
  "parsedOutput": {
    "event": "auth_failed",
    "host": "lab-02",
    "src_ip": "203.0.113.42",
    "user": "demo",
    "trace": "T-0007"
  },
  "validation": {
    "requiredFields": [
      "event",
      "host",
      "src_ip",
      "user",
      "trace"
    ],
    "requiredFieldsPresent": true,
    "documentationAddressRange": "203.0.113.0/24",
    "sourceAddressIsInDocumentationRange": true,
    "result": "PASS"
  },
  "auditLog": [
    {
      "seq": 1,
      "step": "decode-base64",
      "result": "PASS",
      "outputBytes": 94
    },
    {
      "seq": 2,
      "step": "parse-json",
      "result": "PASS",
      "fieldCount": 5
    },
    {
      "seq": 3,
      "step": "validate-schema",
      "result": "PASS",
      "requiredFieldCount": 5
    },
    {
      "seq": 4,
      "step": "classify-source-ip",
      "result": "PASS",
      "classification": "RFC 5737 TEST-NET-3 documentation range"
    }
  ],
  "sha256OfDecodedText": "8781d41cb21ff0d6d4ed286325e239af019be320feace7c2b8363f1970f8f0ad",
  "executionNote": "The From Base64 operation and decoded output were checked in the official GCHQ CyberChef browser app. JSON parsing and field/IP validation are reproduced locally by this script."
}