Initial OfficeCom Sentinel client and deployment assets

docs/attacktracer-ninja-v2-deployment.md

@@ -0,0 +1,103 @@
+# AttackTracer Ninja V2 Deployment
+
+## Goal
+
+Deploy and update the endpoint client through NinjaOne while hosting release artifacts in GitLab.
+
+## Release assets
+
+Each GitLab release should publish:
+
+- `OCSentinelClient-win-x64.zip`
+- `OCSentinelClient-win-x64.zip.sha256`
+- `version.json`
+
+Build these locally with:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\build\build-client-package.ps1
+powershell -ExecutionPolicy Bypass -File .\build\build-release-manifest.ps1 `
+  -ArtifactUrl "https://gitlab.example.com/group/project/-/releases/v2.0.0/downloads/OCSentinelClient-win-x64.zip"
+```
+
+See example manifest:
+
+- [update-channel.example.json](C:/Users/Besitzer/Documents/AttackTracerNinjaVersion/config/update-channel.example.json)
+
+## Endpoint package contents
+
+The installed package should include:
+
+- `app\OCSentinelCli.exe`
+- `scripts\run-ocsentinel.ps1`
+- `scripts\run-ocsentinel-monitor.ps1`
+- `scripts\update-ocsentinel.ps1`
+- `scripts\protect-ocsentinel-secret.ps1`
+- `config\ocsentinel-settings.json`
+- `config\ocsentinel-client.json`
+
+## Initial install through NinjaOne
+
+Recommended NinjaOne task:
+
+```powershell
+& "C:\Program Files\OCSentinel\scripts\update-ocsentinel.ps1" `
+  -ManifestUrl "https://gitlab.example.com/group/project/-/releases/permalink/latest/downloads/version.json" `
+  -Force
+```
+
+If the client is not installed yet, you can also first distribute a bootstrap ZIP or setup package, then switch to the updater-only model.
+
+## Routine update task
+
+Recommended scheduled task command:
+
+```powershell
+& "C:\Program Files\OCSentinel\scripts\update-ocsentinel.ps1" `
+  -ManifestUrl "https://gitlab.example.com/group/project/-/releases/permalink/latest/downloads/version.json"
+```
+
+## Behavior
+
+The updater:
+
+1. downloads the manifest
+2. compares installed and available version
+3. downloads the ZIP only when newer
+4. validates SHA-256
+5. validates Authenticode signature when present
+6. runs the package installer
+
+## Secret bootstrap
+
+After installation, provision the upload secret once:
+
+```powershell
+& "C:\Program Files\OCSentinel\scripts\protect-ocsentinel-secret.ps1" `
+  -SecretValue "<shared-ingest-secret>"
+```
+
+This writes a DPAPI-protected file under:
+
+- `C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat`
+
+## Runtime task
+
+Recommended runtime task:
+
+```powershell
+& "C:\Program Files\OCSentinel\scripts\run-ocsentinel-monitor.ps1" `
+  -Mode status `
+  -OutputPath "..\reports\attacktracer-summary.json"
+```
+
+Upload is enabled automatically when:
+
+- `config\attacktracer-client.json` exists
+- the protected secret file exists
+
+Otherwise the client falls back to local scan behavior.
+
+## Migration guidance
+
+During migration you can keep old share-based logic disabled by default and only enable the new n8n upload path as secrets and webhook config become available.