Kafka-powered control plane with Temporal playbooks, approval workflows, and OT Safety Gate denials after human approve.
Temporal-orchestrated playbooks with human approval workflows.
SIEM + SOAR
Edge mirrors traffic from a SPAN port or hardware TAP at the industrial DMZ and parses OT protocols locally.
Events land in a SQLite WAL store-and-forward queue (~5,000 events) so a link outage never loses telemetry.
HMAC-SHA256 signed batches, optionally mTLS, are shipped to Core over the ingest network only.
Threat-intel fusion adds OTX, Abuse.ch, ThreatFox, MITRE TAXII, and GreyNoise context in flight.
Cascading W15 / W60 / W24 windows assemble events into kill chains and flag Enterprise→OT pivots explicitly.
Risk scoring, compliance auto-mapping, and Temporal playbooks with human approval and OPA guardrails.
Detections, approvals, and denials are hash-chained and Ed25519-signed into the evidence vault.
Response
Playbooks require human approval on OT-affecting classes — and OPA evaluates the action independently, so it can deny even after an analyst approves it.
Correlation windows
Detection, response action, and approval decisions are written as immutable records.
Each record is hashed and chained to its predecessor — any edit breaks the chain.
Ed25519 signatures seal the chain using Vault-backed key material.
Chain verification runs on demand; lab run verified 66 entries OK.
Auditor-ready ZIP packets with policy reason codes, including OT denials.
Data pipeline
The Analyst Copilot console an analyst actually works in — Unified SOC through response playbooks — behind the same indigenous SIEM/SOAR plane described on this page.
A dedicated CyberDragon tenant on your own traffic — not a slide deck. See kill-chain cyber defense on your network.
