Guided workflows (beta)

Named mission playbooks. What they check, and what they do not.

The pricing pages advertise "guided mission workflows (beta)" on Pro and above. This page names the workflows that ship today, describes what each one detects, and states what beta means so a buyer can tell whether the feature meets their need before subscribing.

Observe-only playbooks

Run against pasted UART or boot logs, or during a connected session in a passive mode. No commands are transmitted, so target state is unchanged. Suitable on any device you have permission to inspect.

U-Boot Attack Path Detector

Risk: Low

Passive detector for U-Boot indicators that map to known attack paths, without transmitting commands. Flags the U-Boot banner, an interactive prompt, an autoboot-interrupt window, and boot-verification failure lines when they appear in the log.

observe.uboot.recon

Boot Interrupt Attack Path Detector

Risk: Medium

Passive detector focused specifically on evidence that boot can be interrupted from the console. Looks for the interrupt-window prompt and any visible autoboot countdown.

observe.boot.interrupt

Linux Attack Path Detector

Risk: Low

Passive detector for Linux shell exposure and privilege-related attack paths. Identifies the kernel version, BusyBox, an unauthenticated root shell prompt, and kernel-panic signals.

observe.linux.recon

U-Boot Read-Only Detector

Risk: Medium

Read-only signatures for U-Boot attack paths. Does not send commands. Confirms the prompt is live, flags exposed boot-environment variables (bootargs, bootcmd, baudrate), and reports memory/board context leaks.

safe.uboot.readonly

Linux Read-Only Detector

Risk: Medium

Read-only signatures for Linux attack paths. Does not send commands. Confirms a shell prompt is live and reports kernel details, OS release strings, and CPU/hardware identifiers that leak on boot.

safe.linux.readonly

Active playbooks

Transmit commands over a live UART session and can alter target state. Only run against hardware you own or have explicit written authorization to test.

U-Boot Active Payloads

Risk: High

Active transmit module for high-risk bootloader actions. Requires a live UART session with an interruptible U-Boot prompt. Steps: confirm prompt is ready, attempt boot interruption, run an environment-mutation probe (setenv bootdelay 1). Can alter target state; authorized hardware only.

advanced.uboot.control

What (beta) means here

  • The catalog above is what ships today. Names, keys, and step definitions can change between releases; subscribers get notified via the changelog before a step is removed or renamed.
  • Detector rules (regex matchers, expected-state gates) are refined based on real device logs and can be tightened or broadened between minor releases. Confidence labels on findings reflect this.
  • New workflows are added when we can back them with real evidence from covered device families. There is no committed release cadence.
  • We do not charge extra for workflows added during beta, and workflows removed during beta do not reduce the tier price.

Where they run

Observe-only workflows run against any boot log, including pasted content on /terminal and analyzed sessions in the dashboard. Active workflows require a live UART session established through the connect flow and a device you have authorization to test.

Every run produces a mission run record with per-step evidence and detected state, retained under the same retention window as scans on your plan.

See which tiers include guided workflowsFull detector coverage