平台 — 覆盖每一层防御的统一平台

Architecture & Capabilities

为需要证据而非承诺的团队打造

Signed collectors

Linux syslog, Windows Event Forwarding, AWS CloudTrail, OpenTelemetry and webhooks.

Immutable evidence

Every raw event is checksummed with SHA-256 and kept read-only for the retention period.

Versioned Sigma rules

Readable, testable detections mapped to MITRE ATT&CK, with change history.

Idempotent ingestion

Duplicate events are recognised by key so retries never create duplicate alerts.

ARYA SAI summaries

Redacted, evidence-linked advisory summaries with calibrated confidence.

Approval-gated response

Host isolation and credential revocation require a named approver.

Visual Architecture

Deterministic Sigma Correlation

Versioned Sigma rules evaluate normalised Linux, Windows, AWS CloudTrail and OpenTelemetry streams against MITRE ATT&CK with zero opaque black-box scoring.

Visual Architecture

Human-Gated Containment & ARYA SAI Triage

Every alert is enriched with PII-redacted ARYA SAI evidence summaries while host isolation and credential revocation await explicit human step-up approval.

Verified Architecture Specifications · E-E-A-T Grounding Reference

Deterministic Technical Controls & Machine-Verifiable Evidence

OpenAPI 3.1 Contract Trust & PQC Center

1. Detection Engine (CSH Sentinel): Git-versioned Sigma rules (CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001, T1098.003, T1048, T1190) with idempotent dedupe_key ingestion and SHA-256 immutable event hashes.
2. AI & MCP Firewall (CSH AI Guard): Pre-inference DLP scrubbing ([REDACTED_SECRET], [REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking.
3. Database Isolation (PostgreSQL 16): Enforces ENABLE / FORCE ROW LEVEL SECURITY across all 20 tenant tables bound to transaction-local current_tenant_id(); cross-tenant queries fail closed with HTTP 403.
4. Human-Gated Containment: Zero autonomous destructive actions. Host isolation (isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail.
5. Verified Exposure & GRC (CSH Scan): Cryptographic DNS TXT or HTTP ownership token required before scanning. Continuous evidence aligned with 网络安全等级保护 2.0 (MLPS 2.0), 数据安全法 (DSL), 个人信息保护法 (PIPL).
6. Post-Quantum Roadmap (CSH Quantum): Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (ML-KEM / ML-DSA), and 2035 full PQC completion.

Operated by ARYA AI TECHNOLOGY LTD (Registered in England & Wales, Company No. 17372232) · Canonical Domain: cybersecurityhouse.com Regional Data Residency: UK-LON · EU-FRA · MENA-RUH · APAC-TYO · RFC 9116: /.well-known/security.txt

Live Global Threat Intelligence & Sensor Radar

14.2M PPS eBPF Sensor Telemetry & Autonomous Threat Correlation

4 Sovereign Nodes Active 14,248,910 PPS

LIVE THREAT STREAM:

CRITICAL CVE-2026-3841 AI Agent Indirect Injection · Blocked in 0.42ms

HIGH LockBit 3.0 Variant Canary tripwire engaged · Session isolated

CRITICAL C2 DNS Tunneling 185.220.101.5 · eBPF XDP Dropped

MED OCPP EVSE Probe Unauthorized RemoteStop · HTTP 403 Enforced

CRITICAL PQC Key Drift Weak RSA-2048 detected · ML-KEM-768 upgraded

Attack Surface Risk Index (ASRM) Continuous Unified Exposure

12 /100

✔ OPTIMAL DEFENSE (LOW)

Zero exposed management ports, eBPF line-rate active, all AI tools allowlisted.

Kernel-Level eBPF XDP Velocity Userspace Context Switch: 0ms

0.42 ms Median Packet Drop Latency

100% Deterministic Sigma Precision

Kernel Bypass: None CPU Load: < 0.8%

London 24/7 Human-Led SOC Canary Wharf Command Desk

3m 18s P1 Verified Triage Speed

0 Unverified False Alarms

Tier-4 Lead Analysts 100% Human Sign-Off

Real Attack Dissection · London SOC Command

Anatomy of an Attack: How Our London SOC Neutralized a Multi-Stage Intrusion

Advanced threat actors leverage legitimate operating system binaries (LOLBAS) to evade standard antivirus. Here is how our London SOC engineering team intercepted and neutralized a live intrusion in 3 minutes.

100% HUMAN GOVERNED

STAGE 01 · T1078

Initial Access & Session Hijack

Adversary attempted lateral movement using an infostealer-harvested session token.

AUTH_ANOMALY · Geo-Drift (UK to RU)

STAGE 02 · T1059.001

Defense Evasion & LOLBAS

Attacker spawned encoded PowerShell to bypass AMSI. Kernel eBPF sensor froze execution thread.

SIGMA: proc_creation_win_lolbas_mshta

STAGE 03 · T1048

ARYA SAI Triage & Redaction

Logs sanitized with pre-inference DLP; evidence dossier routed to London On-Call SOC Lead.

ARYA SAI Confidence: 0.94 (High)

STAGE 04 · CONTAINED

1-Click Human Containment

SOC engineer executed named sign-off; infected endpoint quarantined at NIC, tokens revoked.

STATUS: Contained in 3m 18s

Interactive Defense Sandbox

Simulate a Live Attack Now (eBPF Sub-Millisecond Kernel Kill)

Launch safe synthetic intrusion scenarios directly from your browser to witness how CSH Sentinel kernel eBPF hooks intercept and quarantine malware before disk encryption occurs.

eBPF KERNEL LOCK < 0.5 ms Average Intercept Latency

# [CSH-eBPF-LAB] System ready on Equinix LD4 (London LD4 Enclave). Select an attack scenario above to run verification...

> Ready for synthetic payload dispatch. Kernel hooks: sys_renameat2, sched_process_exit, ebpf_xdp_drop.

Defense-in-Depth Isolation

Database-enforced tenant boundaries & UK NCSC PQC alignment.

PostgreSQL 16 FORCE ROW LEVEL SECURITY on all 20 tenant tables.
Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.

Inspect OpenAPI 3.1 Spec

db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16

ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE security_events FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON security_events
  FOR ALL TO csh_app_role
  USING (organization_id = current_tenant_id())
  WITH CHECK (organization_id = current_tenant_id());

Isolation: Enforced · Cross-tenant queries return HTTP 403

常见问题

AI 会自行执行隔离或阻断操作吗？

不会。威胁检测由确定性 Sigma 规则驱动，ARYA SAI 仅基于脱敏证据生成辅助摘要，任何隔离操作均需指定人员审批。

我们的数据存储在哪里？

您可以在开通时选择英国（伦敦）、欧盟（法兰克福）或企业版亚太专属区域。

是否支持 ISO 27001、等保 2.0 与 PIPL 合规准备？

是的，CSH Compliance 可将持续采集的技术证据自动关联至 ISO/IEC 27001、GDPR 及数据安全合规控制项。

可以扫描任意域名或 IP 吗？

仅限您通过 DNS TXT 或 HTTP 令牌证明所有权的资产。

是否支持托管安全服务商 (MSP)？

支持委托子租户管理、许可证池化与合作伙伴结算。

在您自己的环境中亲眼看看

与安全工程师进行 30 分钟演示，没有幻灯片。

英国注册公司（企业编号：17372232）
英国及欧盟数据驻留
支持 15 种语言