/debrief

description: Post-engagement lessons learned analysis and debrief report
allowed-tools: Bash, Read, Write, Glob, Grep
argument-hint:

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Post-Engagement Debrief

Analyze the entire engagement and produce a structured lessons-learned report.

Phase 1: Gather All Data

Run these in parallel:

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" list
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" list
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" coverage
node "${CLAUDE_PLUGIN_ROOT}/scripts/chain-detector.js"
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show
node "${CLAUDE_PLUGIN_ROOT}/scripts/scan-profile.js" show 2>/dev/null
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" summary 2>/dev/null

Also check for and read:

• `scope.md` — original engagement scope
• `engagement-context.md` — engagement rules
• Any `plan-*.md` or `PLAN.md` files — original attack plans
• `attacks/WEAPONIZATION-REPORT.md` — if weaponization was done

Phase 2: Analyze

Build analysis across these dimensions:

What Worked

• Techniques with `success` or `partial` results
• Findings by severity — what was the highest-impact discovery?
• Chains detected — which combinations proved most dangerous?
• Tools with highest success rates

What Was Blocked

• Techniques with `blocked` result — what defenses stopped us?
• Active blockers from session state — were any unresolved?
• Profile escalations — did we need to switch from loud to stealth?

Coverage Gaps

• From techniques coverage report — what categories were never tested?
• Attack surface not reached — endpoints, services, protocols untouched
• Tools available but never used

Effort Distribution

• How many techniques per target?
• How many sessions were needed?
• Time from first scan to final finding
• Scans-to-findings ratio (efficiency)

Campaign Execution

• Phases completed vs planned
• Pivots taken (from decisions log)
• Steps skipped or repeated
• Agent success/failure rates

Phase 3: Write Debrief Report

Write the report to `DEBRIEF-{YYYY-MM-DD}.md` in the project directory:

# Engagement Debrief

**Target**: {from scope}
**Date**: {engagement date range}
**Sessions**: {count}
**Profile**: {scan profile used}

## Executive Summary
{3-5 sentences: what was tested, what was found, overall risk posture}

## Results Overview
| Metric | Value |
|--------|-------|
| Total findings | {n} |
| Critical | {n} |
| High | {n} |
| Medium | {n} |
| Low/Info | {n} |
| Exploit chains | {n} |
| Techniques tried | {n} |
| Success rate | {%} |

## What Worked
{Analysis of successful techniques, tools, and approaches}

## What Was Blocked
{Defenses encountered, techniques that failed, unresolved blockers}

## Coverage Gaps
{What wasn't tested and why — potential blind spots}

## Effort Analysis
{How time/resources were distributed across the engagement}

## Key Decisions & Pivots
{From the decisions log — strategic choices that shaped the engagement}

## Lessons Learned
1. {Lesson 1 — what would we do differently?}
2. {Lesson 2 — what approach should be repeated?}
3. {Lesson 3 — what tools/techniques were most effective?}

## Recommendations for Future Engagements
- {Recommendation 1}
- {Recommendation 2}
- {Recommendation 3}

## Appendix: Full Technique Log
{Summary table of all techniques tried, results, and reports}

Phase 4: Log & Present

node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" add "debrief" "<target>" "post-engagement-analysis" "success" --report "DEBRIEF-{date}.md"
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" add-note "Debrief generated: DEBRIEF-{date}.md"

Present the key findings and report path to the user.