SIEM + SOAR
Unified SOC command center
- Kafka ingest → detect → correlate → decide inside Core.
- MITRE ATT&CK coverage and 24h detection timeline on one board.
- Built for global SOC teams and MSSP tenants.
CyberDragon Core · Control plane
Indigenous SIEM/SOAR control plane for plant-connected estates.
~62 microservices behind a single reverse proxy. Identity, ingest, threat intel fusion, kill-chain detection, risk, compliance, Temporal-orchestrated response, and a tamper-evident evidence vault. Layout and theme are distinct from Edge.
Hard rules
Telemetry up only. Sovereign identity. Dual-gate OT response.
No command plane into L0–L2
Core never pushes control into Purdue process networks. Edge is passive-first.
Human approval AND OPA
OT-affecting automation requires both. Policy can deny even after analyst approval.
Sovereign identity
Hybrid ML-DSA-65 + Ed25519 JWTs. No third-party IdP dependency for core sessions.
Evidence-grade audit
Hash-chained, Ed25519-signed vault with ZIP export for auditors and regulators.
All 15 Core modules
Lead with LIVE. Label PARTIAL honestly.
01 · Sovereign Identity (PQC)
liveML-DSA-65 + Ed25519 hybrid JWTs; MFA; API keys; Vault-backed signing keys.
02 · Kill-Chain Detection
liveCascading W15 (15 min) / W60 (1 hr) / W24 (24 hr) correlation windows.
03 · Enterprise→OT Pivot Detection
liveExplicit signaling when enterprise compromise precedes OT-side anomalies.
04 · Threat Intelligence Fusion
liveOTX, Abuse.ch, ThreatFox, MITRE TAXII, GreyNoise — in-flight enrichment.
05 · Vulnerability Intelligence (VSI)
liveMirrored NVD/CVE/CPE, CISA ICS-KEV, and OSV for local, offline-safe query.
06 · Risk Engine
partialAsset risk plus FAIR-style scenario scoring, 0–100.
07 · Compliance Auto-Mapper
partialEvents mapped to controls automatically — roughly 7 controls per network event.
08 · Framework Packs
partialIEC 62443-3-3, NERC CIP, NIST CSF 2.0, ISO 27001:2022, SOC 2.
09 · SOAR / Response
liveTemporal-orchestrated playbooks with human approval workflows.
10 · OT Safety Guardrails
liveOPA policy can deny actions even after human approval on OT-affecting classes.
11 · Evidence Vault
liveHash-chained, Ed25519-signed, tamper-evident audit trail with ZIP export.
12 · Attack-Path Graph
partialNeo4j-backed cyber-physical knowledge graph.
13 · Executive Reporting
partialBoard PDFs, CISO monthly digests, auditor packets.
14 · Marketplace
partialDetection packs and partner integration catalog.
15 · MSSP Portal
partialCross-tenant operations, client onboarding, portfolio views.
Response
SOAR playbooks with OT guardrails
- Run playbooks as Temporal workflows — not a fire-and-forget script.
- Tier-3 OT actions still need dual approval.
- OPA can deny an action even after a human clicks approve.
Runtime substrate
The systems Core is actually built on.
| Component | Role in the control plane |
|---|---|
| Apache Kafka | Event backbone for ingest, normalization, enrichment, and detection topics. |
| PostgreSQL + RLS | Primary store with row-level security enforcing structural tenant isolation. |
| Neo4j | Cyber-physical knowledge graph powering attack-path and blast-radius queries. |
| Temporal | Durable orchestration for response playbooks and human approval workflows. |
| Open Policy Agent | Platform ABAC plus the OT guardrails that can deny an approved action. |
| HashiCorp Vault | Custody of Ed25519 and ML-DSA-65 signing material. |
| nginx + TLS 1.3 | Single-hostname reverse proxy in front of roughly 62 microservices. |
Threat intel
TI Fusion Center
- OTX, Abuse.ch, ThreatFox, MITRE TAXII, and GreyNoise in-flight.
- Intel joins the same kill-chain timeline as Edge protocol events.
- Not a separate dashboard silo.
Pipeline
Seven stages between the plant and the auditor.
01
Capture
Edge mirrors traffic from a SPAN port or hardware TAP at the industrial DMZ and parses OT protocols locally.
02
Buffer
Events land in a SQLite WAL store-and-forward queue (~5,000 events) so a link outage never loses telemetry.
03
Transport
HMAC-SHA256 signed batches, optionally mTLS, are shipped to Core over the ingest network only.
04
Enrich
Threat-intel fusion adds OTX, Abuse.ch, ThreatFox, MITRE TAXII, and GreyNoise context in flight.
05
Correlate
Cascading W15 / W60 / W24 windows assemble events into kill chains and flag Enterprise→OT pivots explicitly.
06
Decide
Risk scoring, compliance auto-mapping, and Temporal playbooks with human approval and OPA guardrails.
07
Seal
Detections, approvals, and denials are hash-chained and Ed25519-signed into the evidence vault.
FAQ
Frequently asked questions.
What runs inside Core?
Around 62 microservices behind a single-hostname nginx reverse proxy: identity, ingest, Kafka normalization, TI fusion, detection, graph, risk, compliance, response, and evidence.
Which datastores are used?
PostgreSQL with row-level security, Neo4j for the attack-path graph, Kafka for the event pipeline, Temporal for orchestration, and HashiCorp Vault for signing keys.
Can Core run on-premises?
Yes. Sovereign on-prem (Mode B) runs the full control plane at your site, including air-gapped installs.
Start your 7-day free trial.
A dedicated CyberDragon tenant on your own traffic — not a slide deck. See kill-chain cyber defense on your network.