开发者 — OpenAPI 3.1 REST API | Cyber Security House

Architecture & Capabilities

为需要证据而非承诺的团队打造

OpenAPI 3.1 contract

Strongly typed REST endpoints with machine-readable schemas served at /openapi.yaml.

Scoped SHA-256 keys

Collector and API tokens are displayed once on creation and stored exclusively as SHA-256 hashes.

HMAC-SHA256 webhooks

Signed webhook delivery with 300-second replay window enforcement and event-id idempotency.

Idempotent ingestion

Every event ingestion call accepts a client dedupe_key so network retries never create duplicate alerts.

RFC 9457 Problem Details

Standardized application/problem+json error responses across all authentication and validation boundaries.

ARYA SAI adapter contract

Pluggable provider interface supporting deterministic mock testing and live mTLS inference.

Visual Architecture

OpenAPI 3.1 & Idempotent Ingestion Pipeline

Strictly typed REST contracts with client dedupe_key idempotency, RFC 9457 Problem Details and SHA-256 hashed collector tokens.

Visual Architecture

Signed HMAC-SHA256 Webhooks & Sovereign Mesh

Delivers real-time alert and approval events with 300-second replay window enforcement across regional data residency boundaries.

Verified Architecture Specifications · E-E-A-T Grounding Reference

Deterministic Technical Controls & Machine-Verifiable Evidence

OpenAPI 3.1 Contract Trust & PQC Center

1. Detection Engine (CSH Sentinel): Git-versioned Sigma rules (CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001, T1098.003, T1048, T1190) with idempotent dedupe_key ingestion and SHA-256 immutable event hashes.
2. AI & MCP Firewall (CSH AI Guard): Pre-inference DLP scrubbing ([REDACTED_SECRET], [REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking.
3. Database Isolation (PostgreSQL 16): Enforces ENABLE / FORCE ROW LEVEL SECURITY across all 20 tenant tables bound to transaction-local current_tenant_id(); cross-tenant queries fail closed with HTTP 403.
4. Human-Gated Containment: Zero autonomous destructive actions. Host isolation (isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail.
5. Verified Exposure & GRC (CSH Scan): Cryptographic DNS TXT or HTTP ownership token required before scanning. Continuous evidence aligned with 网络安全等级保护 2.0 (MLPS 2.0), 数据安全法 (DSL), 个人信息保护法 (PIPL).
6. Post-Quantum Roadmap (CSH Quantum): Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (ML-KEM / ML-DSA), and 2035 full PQC completion.

Operated by ARYA AI TECHNOLOGY LTD (Registered in England & Wales, Company No. 17372232) · Canonical Domain: cybersecurityhouse.com Regional Data Residency: UK-LON · EU-FRA · MENA-RUH · APAC-TYO · RFC 9116: /.well-known/security.txt

Defense-in-Depth Isolation

Database-enforced tenant boundaries & UK NCSC PQC alignment.

PostgreSQL 16 FORCE ROW LEVEL SECURITY on all 20 tenant tables.
Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.

Inspect OpenAPI 3.1 Spec

db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16

ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE security_events FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON security_events
  FOR ALL TO csh_app_role
  USING (organization_id = current_tenant_id())
  WITH CHECK (organization_id = current_tenant_id());

Isolation: Enforced · Cross-tenant queries return HTTP 403

常见问题

AI 会自行执行隔离或阻断操作吗？

不会。威胁检测由确定性 Sigma 规则驱动，ARYA SAI 仅基于脱敏证据生成辅助摘要，任何隔离操作均需指定人员审批。

我们的数据存储在哪里？

您可以在开通时选择英国（伦敦）、欧盟（法兰克福）或企业版亚太专属区域。

是否支持 ISO 27001、等保 2.0 与 PIPL 合规准备？

是的，CSH Compliance 可将持续采集的技术证据自动关联至 ISO/IEC 27001、GDPR 及数据安全合规控制项。

可以扫描任意域名或 IP 吗？

仅限您通过 DNS TXT 或 HTTP 令牌证明所有权的资产。

是否支持托管安全服务商 (MSP)？

支持委托子租户管理、许可证池化与合作伙伴结算。

在您自己的环境中亲眼看看

与安全工程师进行 30 分钟演示，没有幻灯片。

英国注册公司（企业编号：17372232）
英国及欧盟数据驻留
支持 15 种语言

开发者 — OpenAPI 3.1 & HMAC-SHA256 Webhooks