HOST — Host capture tags

Use this tag

Coming Soon. This team offering has no installer, checkout or active service yet.

See How it works for its intended job. Help improve this tag to contribute or follow its progress.

Baseline job

Capture supported artifacts at a host or managed-device layer.

What the tag can claim

An organization capability supporting tags, not a new detection verdict or an accepted protocol code.

Method and evidence

• Planned organization layer over independently validated tag methods.
• Development · standard v0.1.0

Input

Organization configuration and supported tag records.

Output

A versioned tag record with subject binding, method, evidence, limitations, and a result state.

Supported scope

• Proposed organization-only capability

Limits

• Requires consent, least privilege, and a reviewed capture boundary
• Underlying personal detection and evidence remain free

Accuracy and validation

No enterprise implementation or conformance evidence exists.

Cost and access

Proposed paid organization offering. Pricing is not set; no purchase or subscription is available.

Privacy

This catalogue does not evaluate your content. The personal reference implementation uses local services; detected redaction can miss sensitive information.

Dependencies

• Versioned claim and evidence contract
• Independent review for this tag
• Accessible presentation and a clear failure state

Failure behavior

A failed or unsupported check must not become a finding. A problem with this tag must not disable unrelated tags.

Who owns the outcome

Maintainers own implementation; independent reviewers own validation; the product owner accepts release.

Before release

Publish agreed acceptance criteria, run independent validation, and verify the complete user workflow before release.

Tag enhancements in scope

• F-160 — Host-level capture agents. Specify and deliver host-level capture agents. Scope record; not an implementation claim.

Shared tag capabilities

• F-001 — Assertion envelope schema, JSON Schema 2020-12. Specify and deliver assertion envelope schema, JSON Schema 2020-12. Scope record; not an implementation claim.
• F-003 — Signal registry, 22 registered IDs with version suffixes. Specify and deliver signal registry, 22 registered IDs with version suffixes. Scope record; not an implementation claim.
• F-004 — Abstention as a first-class state — UNK. Specify and deliver abstention as a first-class state — UNK. Scope record; not an implementation claim.
• F-005 — Per-tag confidence floors. Specify and deliver per-tag confidence floors. Scope record; not an implementation claim.
• F-007 — Content-free assertion records. Return hashes, offsets, and metadata without embedding evaluated text Scope record; not an implementation claim.
• F-008 — Signed assertion integrity. Sign an exact canonical tag record with an identified key Scope record; not an implementation claim.
• F-009 — Cost-to-defeat ladder — statistical / behavioural / structural / cryptographic. Specify and deliver cost-to-defeat ladder — statistical / behavioural / structural / cryptographic. Scope record; not an implementation claim.
• N-005 — Label dispute, correction, and supersession workflow. Specify and deliver label dispute, correction, and supersession workflow. Scope record; not an implementation claim.
• N-006 — Versioned regression checks and revalidation triggers. Specify and deliver versioned regression checks and revalidation triggers. Scope record; not an implementation claim.

References

• public-scope.json

Scope record F-160. Preserved scope is not implementation evidence.