> For the complete documentation index, see [llms.txt](https://darkcybe.gitbook.io/holocron/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://darkcybe.gitbook.io/holocron/start-here.md).

# Start Here

Choose a route through the archive and understand what its evidence labels mean.

`READER BRIEFING`

Start with the question you need to answer. The archive is arranged around investigation, detection and engineering work, with references for the details you need to look up repeatedly.

| Your question                                   | Route                                               | Useful output                                                |
| ----------------------------------------------- | --------------------------------------------------- | ------------------------------------------------------------ |
| What happened, and what supports that account?  | [Investigate](/holocron/investigate/investigate.md) | A timeline with evidence and uncertainty attached            |
| How would we recognise this behaviour?          | [Detect](/holocron/detect/detect.md)                | A hypothesis, telemetry requirements and validation criteria |
| How can I reproduce or engineer this?           | [Build](/holocron/build/build.md)                   | An experiment or design with explicit boundaries             |
| What does this field, artifact or command mean? | [Reference](/holocron/reference/reference.md)       | A concise answer with applicability and caveats              |
| What is worth examining next?                   | [Dispatches](/holocron/dispatches/dispatches.md)    | A focused observation, tool assessment or research question  |

## A first read

Start with [Evidence of Program Execution](/holocron/investigate/investigate/evidence-of-program-execution.md). It asks what supports the claim that a Windows program ran, then separates file presence, artifact references, evidence consistent with execution and directly recorded process creation.

Its **SOURCE VALIDATED** label means the interpretations were checked against cited sources within the stated version and configuration limits. It does not mean every artifact was reproduced in a fresh lab. Use the corroboration workflow, then check what telemetry your own environment actually collected.

## Read the evidence label

**LAB VALIDATED** means the described procedure or result was reproduced in an authorised lab. Read the environment and evidence to see exactly what was tested; the label does not extend to other versions or deployments.

**SOURCE VALIDATED** means the claims were checked against cited sources. It does not mean the procedure was reproduced end to end.

**FIELD NOTE** identifies observation, analysis or opinion. It should tell you whose observation it is, its context and what remains uncertain.

Published dates describe release history. Last verified dates describe the most recent technical check within the stated scope. Neither guarantees that a method fits your environment today.

## Notes in the margin

**K-2AI** callouts highlight an interpretation trap or a practical check; they are editorial assistance, not additional evidence. **DEATH STAR LAB CAPTURE** prompts identify a future screenshot that would help explain the method. A prompt is not a completed experiment or an existing image.

## Carry the reasoning with the result

When using a technical article, keep its prerequisites, evidence and limitations together. A command without the expected output is difficult to assess; an output without interpretation is easy to overread. If an article leaves an important question unresolved, treat it as unresolved.

[About Darkcybe and K-2AI](/holocron/about/about.md) explains authorship and editorial assistance.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://darkcybe.gitbook.io/holocron/start-here.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.