Ghostwriter's primary goal is bringing all of your operational data together in one place and create relationships. A starting point is needed to accomplish this goal. For Ghostwriter that starting point is a client.
The basic workflow looks like this:
Create a new client, or open an existing client
Review points of contact for the client and add/edit as needed
Create a project under the client
Checkout servers and domain names for the new project
Create the links between domain names, subdomains, and servers
Create an oplog for the project and configure automatic syncing (if C2 is used)
At this stage your project proceeds until it's time to begin noting observations:
Create one or more reports for the new project
Browse the database of findings/observations and applicable entries to the report
Add affected hosts/users, add evidence files, and customize the finding as needed
Return to step 2
Perform peer review/QA of all findings and project details prior to report generation
Upload a report template (optional)
Generate a reporting document (docx, pptx, xlsx, json, etc)
That's all there is to the basic procedures and their required order of precedence.
At the end of a project a project manager or assessment lead should mark a project as complete. This is done by clicking the In Progress toggle below the project's name on the project's detail page.
Marking a project as complete begins a 90-day countdown to archiving. If the archive task has been configured (see Background Tasks), Ghostwriter will perform a daily check to see if any complete projects are 90 days old (or older) and archive them.
Archiving involves the following actions:
Mark all reports under the project to Complete (if they were not marked as such already)
Mark all reports under the project as Archived
Generate all report types
Bundle all reports and evidence files into a zip file
Add a record to the
Archive model for the client and project with the report archive file
Mark the project as archived
Delete all report data
The archive file are available for download under
/reporting/reports/archive. You can leave them or perform any actions required by your company's data retention policies (e.g. download the archive and then delete it from Ghostwriter).
Once archived, the project and reports can no longer be edited, so they now exist only as a historical record.