/aegis/soc/ingest — submit a custom security alert to the SOC shield.

/aegis/soc/ingest/wazuh — endpoint Wazuh posts to when an alert fires.

/aegis/soc/actions/{id}/decide — approve or reject a proposed containment.

/aegis/mail/analyze — BEC + phishing + link-scan + sender-reputation in one call.

/aegis/mail/ingest/raw — paste a full email (with headers) for analysis.

Check Gmail Pub/Sub + Microsoft Graph webhook health.

/aegis/recon/targets — register a domain/IP/CIDR for continuous monitoring.

Surface scan + subdomain-takeover detection + SPF/DMARC check.

Defensive only — proposes attack path + remediation steps.

Run weekly scans automatically across all registered targets.

/aegis/recon/tickets/generate — export finding as Jira / Linear / GitHub / Markdown.

/aegis/comply/evidence — auto-collected compliance evidence (SOC2 / ISO / DPDP).

Customer opts in to share posture data with their cyber-insurance carrier.

Deepfake & synthetic-media defense for Indian BFSI. Three modules: V-CIP injection detection, Synthetic Red-Team-as-a-Service, Synthetic Exposure Score (Underwrite extension). Founding-customer pilots open Q3 2026 — see /synthetic for full spec or /red-team for the service offering.

/aegis/synthetic/vcip/scan — frame-level synthetic-media gate that sits in front of HyperVerge / IDfy / Signzy / in-house V-CIP. Catches injection attacks (virtual cam, replay, frame-stitch) and generated faces in <60 ms p95.

/aegis/synthetic/red-team/engagements — quarterly Hinglish deepfake red-team drills. List active engagements, view kill-chain progress, fetch CERT-In drill log.

/aegis/synthetic/exposure — bolt-on for the Underwrite shield. Computes synthetic-exposure sub-score (public exec footage volume, voiceprint availability, V-CIP coverage, regional voice-clone risk) and ships HMAC-signed monthly delta to your insurer.

/aegis/identity/brands — tell Aria which apex domain, social handles, developer accounts, and ad pages are legitimately yours. Every other match becomes a candidate impersonation.

/aegis/identity/lookalike/hunt — dnstwist-style permutations + live DNS + Certificate Transparency logs. Returns only domains that actually resolve or have been logged.

/aegis/identity/ads/search — Meta Ad Library Graph API + Google Ads Transparency Center. Needs META_ACCESS_TOKEN env var on the server for Meta.

/aegis/identity/takedown/cases — open cases, RDAP-resolved abuse contacts, pre-filled notices.

/aegis/identity/takedown/open — file a case when you spot something outside Aria's automated hunts.

Phishing-resistant MFA is the single largest-leverage identity control. Target: 95% enrollment in 90 days. Every unenrolled user is a password-phishable account. This panel is the board-metric source of truth.

Any department below 80% is the next target for the rollout team.

Worst-first. Admins at the top. Bulk actions drive the 90-day curve.

Device posture × risk × location × user × app. Every cell should be covered by at least one block-on-noncompliant policy. The grid below is a coverage map — red cells are gaps an attacker will find.

Each cell: which enforcement fires. Green = block or require FIDO2. Amber = MFA only. Red = no policy.

Git-backed policy-as-code. Report-only mode is for staging; nothing persists there forever.

Every bypass is a human promise — documented, timeboxed, reviewed.

Evilginx / Tycoon / Caffeine steal the post-MFA session cookie. Password + MFA are already done — the attacker replays the cookie from a different browser and inherits your session. We correlate user-agent, IP-ASN, cookie-age, concurrent session, MFA-to-use delta and kill in < 90 s.

Score ≥ 80 = auto-kill + revoke refresh token. 50-79 = challenge re-auth. 30-49 = monitor + enrich.

Sorted by score. Green = auto-killed. Amber = awaiting decision. Click Kill to revoke + force re-auth.

Attacker has the password. Sprays push notifications until the tired user taps "Approve". Threshold: > 5 push-denies in 60s = auto-lock + force FIDO2 re-enroll. No more push once FIDO2 is enrolled.

Same user authenticates from two cities faster than a commercial flight. Haversine-distance / min-flight-time check. Session-kill + analyst notify + alert in SOAR queue.

The unglamorous controls. Legacy-auth blocked. Long-lived tokens rotated. OAuth consents reviewed. This is where most breaches actually start.

Basic-auth / IMAP / POP3 / SMTP-AUTH / older EAS = MFA bypass. Must be disabled. Exceptions get a ticket, an owner, and an expiry.

OAuth refresh tokens, PATs, service-account keys, CI secrets. Anything older than 90 days is a time-bomb. Rotate to short-lived OIDC wherever possible.

Third-party apps users granted to their workspace — ranked by scope + last-used. Unused for 30d → auto-expire. New high-scope consent → review workflow.

Durable record of every workflow action fired from the Identity tabs — passkey nudges, policy promotions, session kills, token rotations, dormant sweeps. Persisted server-side; survives Cloud Run restarts. Filter by type to triage what just happened.

Before ransomware encrypts, it deletes your backups. If production identity can delete the backup, you don't have a backup. You have a snapshot. Fix this first — nothing else matters if we can't restore.

Every backup bucket must have Object-Lock / GCS-retention / Azure-immutability enabled with MFA-delete. Stored in a separate cloud account from production.

A backup you have never restored is fiction. Monthly random-sample restore test per tier; measure wall-clock time-to-restore. Board metric.

PAM, IGA, access reviews, dormant sweep, admin segregation, and honey-accounts — the unsexy identity plumbing that moves breach probability the most.

Time-boxed elevation with ticket + approver. Full keystroke recording. Auto-revoke on expiry. Tier-0 only.

Plausible admin accounts, never used. Any auth attempt = P0 incident. Zero false-positive detect.

HRIS-driven lifecycle. Birthright roles. On-move entitlement diff. Termination SLA < 15 min.

Managers attest entitlements per quarter. Auto-revoke non-attested. Evidence to compliance.

No login > 30d or no owner. Disable → delete after grace. Includes service accounts.

Offline-printed creds in a sealed envelope. Every retrieval alerts CEO + board SMS. Quarterly test-retrieval proves the process still works.

Service accounts · workload identities · bot accounts · CI runners · LLM agents. Every NHI has an owner + rotation SLA + scope cap.

Analyst picks user → sees active sessions → revokes + rotates refresh + forces re-auth with FIDO2. Primary response action for AiTM / session-theft / MFA-fatigue outcomes.

Tier-0 / 1 / 2 separate accounts. admin- prefix. No tier-0 login from non-PAW.

Where attackers build their campaign. Kerberoast, ADCS misconfigs, and attack-path graph. Shrink the graph monthly or lose ground.

TGS-REQ to odd SPNs + AS-REP with no pre-auth. Honey-SPN seeded for zero-FP alerting.

Certipy-style weekly scan. Flag templates allowing subject supply + client-auth EKU.

Shortest paths to Domain Admin / Global Admin. Shrink count + avg length month-over-month.

EDR coverage, ASR enforcement, LSASS/Credential Guard. These three controls kill 80% of commodity malware.

Target >99.5% coverage across Win / Mac / Linux. Alert on >4h offline. Reconcile to CMDB + DHCP.

Block Office child-process · LSASS cred-steal · webmail macro · obfuscated scripts · USB exec. Audit-then-enforce.

Office macros from MoTW-tagged files are blocked by GPO/Intune. Named exceptions carry an owner + expiry. Monthly review.

LAPS / Intune-driven. Elevation on-demand via ticket. Target: 95%+ users without permanent local admin.

Start audit-mode, weekly diff, move tier-0 hosts to enforce first. Block everything not signed or published.

Mass-storage default-block. Ticketed exceptions by VID/PID. Alert on BadUSB HID typing-speed patterns.

Microsoft vulnerable-driver blocklist enforced. Any unsigned kernel-load + known-bad hash alerts loudly.

TCC · SIP · Gatekeeper · FileVault · XProtect. Jamf/MDM profile diff. 100% FileVault key escrow.

Wazuh/Falco runtime. Cron/systemd-timer enumeration diff. SUID/SUID-over-time drift detect.

Chrome Enterprise / Edge policy. Block install from unmanaged stores. Monthly review of installed extensions.

RunAsPPL + VBS + HVCI. Mimikatz becomes a doorstop. Reconcile incompatibilities (USB tokens, VPN drivers).

Our real perimeter lives in 30 vendor consoles. CIS / Secure Score equivalent pulled nightly from every critical SaaS. Drift alerts. Evidence auto-packaged to compliance.

CIS Microsoft 365 benchmark + Secure Score. Daily pull. Diff. Alert on regression. Evidence bundled to compliance.html.

2SV/FIDO coverage · less-secure-app · external-share defaults · super-admin count · Chrome policy sync.

SSO required · branch protection · signed commits · secret-scan push-protection · Dependabot. Every repo reconciled nightly.

Legacy-auth blocked · conditional-access coverage · break-glass guardrails · social-login exposure.

Guest-account audit · external-file-share · retention · unmanaged-app install · E2EE availability.

API-user scopes · session timeout · IP allow-list · export rate-limit · profile-clone alerts.

Any new high-scope app consented in last 24 h triggers a review workflow. Paired with the Hygiene pane's consent review.

Derived from SSO + DNS + expense data. Identifies unsanctioned apps + owners. Classifies + gates to approved-vendor list.

Graph of Zapier / Make / webhooks / API-keys between apps. Flags transitive-admin chains (e.g. low-priv Zapier with high-priv creds).

Target < 5 super-admins per SaaS. Alert on add. Quarterly certify.

East-west & egress visibility. Every block, every beacon, every DNS-tunnel bucket.

Default-deny outbound from workload subnets. Explicit FQDN list. Alert on block-hits to new destinations.

Umbrella / Quad9 / internal RPZ with block-log. Newly-registered-domain block. DGA scoring. DoH-bypass detect + block.

Per-source entropy on inter-request timing. Flags Cobalt / Sliver / Havoc jitter profiles. Filters out CDN + health-checks.

Per-subdomain volume + label entropy + TXT-size + NULL-query anomaly. Per-host baseline.

App-level access + device-posture gate + per-app policy. Removing network-level VPN where possible.

Managed CA + pinned-app exception list. Inline DLP on inspected traffic.

Zeek / Suricata + per-subnet service-pair baseline. Alert on net-new conversation patterns.

Top blocked ASNs · rule-hit heatmap · FP queue · ML bot-score.

Anycast + volumetric + L7. Origin rate-limit. Table-top twice a year.

SNI vs Host-header divergence. Classic C2 hiding behind trusted CDNs (Cloudfront/Fastly/Akamai).

mDNS/LLMNR poisoning + WPAD abuse signatures on the LAN. SMB-signing coverage tracked.

Nightly internet-scan from external vantage for RDP / SSH / WinRM / K8s-API / Docker sockets. Instant Slack + ticket.

Runs a real cloud security posture scan via POST /api/v1/modules/cspm/scan against the provider and credentials below — covering what the old Multi-Cloud Inventory (T150) and CIS/NIST/PCI Benchmark (T151) sample panels used to show, with an actual scan result in place of fixed rows. Credentials are sent once for this scan only; the secret fields are cleared from this page the moment Run Scan is clicked, and nothing is stored or logged.

Compares this scan to the last one your org ran for this provider via POST /api/v1/modules/cspm/drift — a real per-org baseline stored server-side (backend/src/modules/cspm.py::compute_drift), diffed on each resource's pass/fail status, not a simulated timeline. Each click both reads the stored baseline and replaces it with this scan, so the next check compares against this one.

Unified cloud posture: config + workload runtime + identity entitlement. One view, one attack-path engine.

Drift-to-public auto-revert in < 30s. Slack + ticket with owner. Zero tolerance on buckets holding PII.

Transitive permission graph. Find role-to-admin paths. Tighten trust policies.

Privileged-pod · hostPath · exec-into-pod · secret-read events streamed in real time.

Pod-Security-Admission restricted · OPA/Kyverno policies · network-policy default-deny · image-admission signed-only.

All data stores envelope-encrypted at rest with customer-managed keys. Per-key usage + rotation policy tracked.

Public-to-crown-jewel paths. Ranked by reachability × impact × exploit-probability. Monthly shrinkage metric.

Classify PII / PHI / secrets in stores. Alert on large export or cross-region copy.

Per-project $/hr baseline. Spike alert. Auto-freeze path to SOAR.

Nightly plan. Out-of-band changes flagged. Owner notification + revert option.

Printers, HVAC, PLCs, cameras, phones — every chip is an un-monitored computer. This is where state-level actors live quietly.

NDR + NAC fingerprinting. Owner + firmware version + default-pw flag per device.

Cameras / printers / badge readers can't reach corp servers or the internet. Each device class on its own VLAN with strict allow-list.

Nightly auth-attempt with vendor-default credentials across IoT fleet. Force change + track in CMDB. Findings feed owner via ticket.

The IT-to-OT bridge is the holy grail — treat it as tier-0. Every session brokered, recorded, keystroke-logged.

Alert on unauthorised write · unusual function-code · new talker on the OT segment.

Levels 0-5 with allowed flows. Diff actual vs policy. Any cross-level flow not in policy is a violation.

Intune / Jamf + Lookout / Zimperium. Attestation required. Smishing-block on corp mail app.

Conditional-access rejects jailbroken / rooted. Warns on older-OS. Attestation freshness checked per login.

A CVE list is not a risk report. An attack-path is. CTEM unifies CVE + config + identity + exploit-probability into the paths attackers actually walk.

Rank by exploited-in-wild first, CVSS last. KEV matches are automatic P0.

Internet-facing critical CVE → patched or WAF virtual-patched in 24 h. Exceptions require an owner + expiry.

CVE + config + identity + exposure combined. Path rank = reachability × impact × exploit-probability. Monthly shrinkage is the KPI.

Path count, avg length, % Internet-to-crown-jewel. Board-metric: "are we getting better?"

Per-data-class + per-system tag drives attack-path weighting. "What must never be lost" is a short list, reviewed quarterly.

Weekly safe-run against external surface. Findings diffed; promoted to CTEM + detection-as-code.

Named ATT&CK scenario · pre-agreed window · findings → detection-as-code PRs. Each quarter rotates tactic focus.

/aegis/fleet — public catalog of the agent roles that power every shield. Each agent delegates to one or more internal Claude-powered agents.

/aegis/demo/seed — populate all six shields with realistic sample data so every endpoint shows output.