Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//20350112
9.29 (U) One-way Transfer (OWT) of Cherry Blossom Data
(U) The Cherry Blossom system supports a One-way Transfer (OWT) Report mechanism
to facilitate packaging of and transmittal of Cherry Blossom data to a secure Sponsor
host. Each OWT Report generates a series of data files that contain Cherry Blossom data
collected for a specified Operation (See 8.1.5 through 8.1.7) since the last OWT report
was generated.
pcap
Copy
Data
File(s)
Cherry
Blossom
Reports
<CB>/CherryTree/Release/
Reports
Green
copy.csv
flytrap.csv
harvest.csv
mission.csv
security.csv
status.csv
target_2007_09_01.csv
copyLog_wlanMAC_01:01:01:01:01:01-lanMAC_00:11:22:33:44:55-atime_1.pcap
copyLog_wlanMAC_01:01:01:01:01:01-lanMAC_00:11:22:33:44:55-atime_n.pcap
OWT_2007_09_01 14_32_55
report_summary.csv
alert.csv
Figure 53: OWT Report Structure
(U) As shown in Figure 53, these data files are written to a parent directory named
“./Reports/”, then into a subdirectory named after the Operation (an Operation named
“Green” is used in this example), and finally into another subdirectory named after the
end date of the report. Each file, generated as part of an OWT Report, is formatted as a
comma separated list of values, with the first line of each file containing the column
headings. The report files created from Cherry Blossom data include:
• report_summary.csv – a summary of the OWT report including the date ranges
used to generate the current report.
• mission.csv – a summary of the Missions active at the time the OWT Report is
generated. Includes these columns: Mission Name, Version, Date, State, Kill
Enabled, Suicide Enabled, and Description.
• alert.csv – a summary of alerts received since the last OWT Report was
generated. This report includes the Flytrap where the Alert originated and the
Target that was alerted. Includes these columns: Target Name, Client MAC
Address, Client Duration, Flytrap Name, Receive Date, Actual Date, and Traffic
Direction.
106
SECRET//20350112