CSH Sentinel: Erkennung & Reaktion (SIEM-Lite)

Architecture & Capabilities

Für Teams, die Beweise statt Versprechen brauchen

Signed collectors

Linux syslog, Windows Event Forwarding, AWS CloudTrail, OpenTelemetry and webhooks.

Immutable evidence

Every raw event is checksummed with SHA-256 and kept read-only for the retention period.

Versioned Sigma rules

Readable, testable detections mapped to MITRE ATT&CK, with change history.

Idempotent ingestion

Duplicate events are recognised by key so retries never create duplicate alerts.

ARYA SAI summaries

Redacted, evidence-linked advisory summaries with calibrated confidence.

Approval-gated response

Host isolation and credential revocation require a named approver.

Visual Architecture

Deterministic Sigma Correlation

Versioned Sigma rules evaluate normalised Linux, Windows, AWS CloudTrail and OpenTelemetry streams against MITRE ATT&CK with zero opaque black-box scoring.

Visual Architecture

Human-Gated Containment & ARYA SAI Triage

Every alert is enriched with PII-redacted ARYA SAI evidence summaries while host isolation and credential revocation await explicit human step-up approval.

Verified Architecture Specifications · E-E-A-T Grounding Reference

Deterministic Technical Controls & Machine-Verifiable Evidence

OpenAPI 3.1 Contract Trust & PQC Center

1. Detection Engine (CSH Sentinel): Git-versioned Sigma rules (CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001, T1098.003, T1048, T1190) with idempotent dedupe_key ingestion and SHA-256 immutable event hashes.
2. AI & MCP Firewall (CSH AI Guard): Pre-inference DLP scrubbing ([REDACTED_SECRET], [REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking.
3. Database Isolation (PostgreSQL 16): Enforces ENABLE / FORCE ROW LEVEL SECURITY across all 20 tenant tables bound to transaction-local current_tenant_id(); cross-tenant queries fail closed with HTTP 403.
4. Human-Gated Containment: Zero autonomous destructive actions. Host isolation (isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail.
5. Verified Exposure & GRC (CSH Scan): Cryptographic DNS TXT or HTTP ownership token required before scanning. Continuous evidence aligned with BSI IT-Grundschutz, NIS2-Umsetzungsgesetz, DSGVO (GDPR).
6. Post-Quantum Roadmap (CSH Quantum): Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (ML-KEM / ML-DSA), and 2035 full PQC completion.

Operated by ARYA AI TECHNOLOGY LTD (Registered in England & Wales, Company No. 17372232) · Canonical Domain: cybersecurityhouse.com Regional Data Residency: UK-LON · EU-FRA · MENA-RUH · APAC-TYO · RFC 9116: /.well-known/security.txt

Live Global Threat Intelligence & Sensor Radar

14.2M PPS eBPF Sensor Telemetry & Autonomous Threat Correlation

4 Sovereign Nodes Active 14,248,910 PPS

LIVE THREAT STREAM:

CRITICAL CVE-2026-3841 AI Agent Indirect Injection · Blocked in 0.42ms

HIGH LockBit 3.0 Variant Canary tripwire engaged · Session isolated

CRITICAL C2 DNS Tunneling 185.220.101.5 · eBPF XDP Dropped

MED OCPP EVSE Probe Unauthorized RemoteStop · HTTP 403 Enforced

CRITICAL PQC Key Drift Weak RSA-2048 detected · ML-KEM-768 upgraded

Attack Surface Risk Index (ASRM) Continuous Unified Exposure

12 /100

✔ OPTIMAL DEFENSE (LOW)

Zero exposed management ports, eBPF line-rate active, all AI tools allowlisted.

Kernel-Level eBPF XDP Velocity Userspace Context Switch: 0ms

0.42 ms Median Packet Drop Latency

100% Deterministic Sigma Precision

Kernel Bypass: None CPU Load: < 0.8%

London 24/7 Human-Led SOC Canary Wharf Command Desk

3m 18s P1 Verified Triage Speed

0 Unverified False Alarms

Tier-4 Lead Analysts 100% Human Sign-Off

Real Attack Dissection · London SOC Command

Anatomy of an Attack: How Our London SOC Neutralized a Multi-Stage Intrusion

Advanced threat actors leverage legitimate operating system binaries (LOLBAS) to evade standard antivirus. Here is how our London SOC engineering team intercepted and neutralized a live intrusion in 3 minutes.

100% HUMAN GOVERNED

STAGE 01 · T1078

Initial Access & Session Hijack

Adversary attempted lateral movement using an infostealer-harvested session token.

AUTH_ANOMALY · Geo-Drift (UK to RU)

STAGE 02 · T1059.001

Defense Evasion & LOLBAS

Attacker spawned encoded PowerShell to bypass AMSI. Kernel eBPF sensor froze execution thread.

SIGMA: proc_creation_win_lolbas_mshta

STAGE 03 · T1048

ARYA SAI Triage & Redaction

Logs sanitized with pre-inference DLP; evidence dossier routed to London On-Call SOC Lead.

ARYA SAI Confidence: 0.94 (High)

STAGE 04 · CONTAINED

1-Click Human Containment

SOC engineer executed named sign-off; infected endpoint quarantined at NIC, tokens revoked.

STATUS: Contained in 3m 18s

Interactive Defense Sandbox

Simulate a Live Attack Now (eBPF Sub-Millisecond Kernel Kill)

Launch safe synthetic intrusion scenarios directly from your browser to witness how CSH Sentinel kernel eBPF hooks intercept and quarantine malware before disk encryption occurs.

eBPF KERNEL LOCK < 0.5 ms Average Intercept Latency

# [CSH-eBPF-LAB] System ready on Equinix LD4 (London LD4 Enclave). Select an attack scenario above to run verification...

> Ready for synthetic payload dispatch. Kernel hooks: sys_renameat2, sched_process_exit, ebpf_xdp_drop.

Defense-in-Depth Isolation

Database-enforced tenant boundaries & UK NCSC PQC alignment.

PostgreSQL 16 FORCE ROW LEVEL SECURITY on all 20 tenant tables.
Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.

Inspect OpenAPI 3.1 Spec

db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16

ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE security_events FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON security_events
  FOR ALL TO csh_app_role
  USING (organization_id = current_tenant_id())
  WITH CHECK (organization_id = current_tenant_id());

Isolation: Enforced · Cross-tenant queries return HTTP 403

Häufige Fragen

Führt die KI jemals selbstständig Eingriffe durch?

Nein. Die Erkennung basiert auf deterministischen Sigma-Regeln. ARYA SAI erstellt lediglich beratende Zusammenfassungen aus geschwärzten Nachweisen; jede Eindämmung erfordert eine benannte menschliche Freigabe.

Wo werden unsere Daten gespeichert?

Sie wählen beim Onboarding zwischen EU (Frankfurt) und UK (London). Weitere Regionen stehen im Enterprise-Tarif bereit.

Unterstützen Sie BSI IT-Grundschutz, NIS2 und ISO 27001?

CSH Compliance ordnet technische Nachweise automatisch den Kontrollen von ISO/IEC 27001:2022, NIS2, DSGVO und Cyber Essentials zu.

Können beliebige Domains oder IP-Adressen gescannt werden?

Nein. Nur Assets mit bestätigtem Eigentumsnachweis per DNS-TXT oder HTTP-Token können gescannt werden.

Arbeiten Sie mit Managed Service Providern (MSPs) zusammen?

Ja. Die Partner-Edition unterstützt delegierte Mandanten, gepoolte Lizenzen und Partnerabrechnung.

Sehen Sie es in Ihrer eigenen Umgebung

30 Minuten mit einem Security Engineer. Keine Folien.

In UK registriert (Nr. 17372232)
Datenhaltung in UK & EU
In 15 Sprachen verfügbar

CSH Sentinel — Erkennung & Reaktion (SIEM-Lite)