// runnable playbook

election integrity investigation

voter-roll tampering, e-pollbook artifacts, ballot-image chain of custody, election-night messaging spoofing, foreign-influence pattern surfacing.

a guided path, not automation — each step opens a tool you run yourself; nothing uploads. progress is saved only in this browser.

// based on the curated pipeline

wraps the election spoof / influence IOC sweep preset — drop suspect 'official' emails → header validate → pull IOCs → dedupe across sources → severity triage → report

methodology guide →worked example →full tool list + 1 more pipeline →

guided steps

0/6 done

01
evidence manifest generator
preserve raw .eml + screenshots so the chain holds up under election-contest scrutiny
open tool →methodology
your note (local only)
02
email header analyzer
validate SPF / DKIM / DMARC — most election spoof emails fail at least one
open tool →methodology
your note (local only)
03
ioc extractor
pull sender domains, look-alike URLs, IPs from the headers + bodies
suggested options · format: json · aggregate: true
open tool →methodology
your note (local only)
04
ioc deduplicator and normalizer
merge across the suspect message set — a single influence cluster usually shares 3-5 domains
suggested options · lowercase: true · dropPrivate: false
open tool →methodology
your note (local only)
05
ioc bulk validator & triage
score; high-severity IOCs are the ones to escalate to CISA / state election officials
open tool →methodology
your note (local only)
06
case report generator
draft a report formatted for state-level cybersecurity intake
suggested options · title: election spoof / influence IOC sweep
open tool →methodology
your note (local only)

when you're done

export a run summary — a small JSON record of which steps you marked done, your notes, and a self-hash so the record can't be silently altered. it is your reproducibility note, not a per-tool receipt: each tool emits its own input→output receipt when you run it.