Select authorized records for one bounded investigation. Preserve source context, tenant scope and collection gaps.
Engage now
A scoped review of the investigation workflow, authority boundary, implementation gaps and evaluation evidence, with named client and Hyperion responsibilities.
Inspect
Rust research prototype · local lab
Rust-rendered local application, authorized event intake and checkpointed local Wazuh-file collection.
Still to validate
Current containment changes sandbox database state, not endpoint, firewall, cloud or host controls. No production deployment or customer protection result is established.
Review one investigation workflow, its authority boundary and the evidence needed for a permitted evaluation. Live endpoint protection and production containment require separate implementation and qualification.
源码审查日期
The decision behind the system
What may a security assistant investigate, propose and change?
A Rust local-lab prototype connecting authorized event intake, case evidence, separate approval roles and a sandbox response workflow. Production protection remains unqualified.
Hyperion Cyber explores incident evidence and human-approved sandbox response. Achilles inspects source code; Aegis structures governance evidence. These are separate research systems, not an integrated production security suite.
Evidence with context
Import authorized event records and local Wazuh files into tenant-scoped investigations. Make collection gaps, source context and uncertainty visible.
Human-approved sandbox actions
Separate the proposal, approval and execution roles, binding approval to the action digest and case revision. Current containment changes sandbox database state only.
Recovery as part of the record
Inspect revisioned case and asset records and encrypted snapshot recovery. These source mechanisms do not establish production confidentiality or security coverage.
Read the complete system walkthrough
Import
Select authorized records for one bounded investigation. Preserve source context, tenant scope and collection gaps.
Propose
Assemble the case and a proposed response. Optional model explanation does not grant authority or establish that the explanation is correct.
Review
A separate approver reviews the exact proposed action. In the current lab, execution can change sandbox database state only.
Inspect
Review the case revision, action result and recovery conditions. Production protection and live integrations require independent qualification.
Inspect the source, test conditions and operating limits in the technical record.
查看技术记录与证据
业务 ↔ 技术桥梁 · Cybersecurity capability experiment
What may a security assistant investigate, propose and change?
Hyperion Cyber explores incident evidence and human-approved sandbox response. Achilles inspects source code; Aegis structures governance evidence. These are separate research systems, not an integrated production security suite.
这是对项目组合与源代码的解读，并非客户、部署、认证或成果声明。
01
业务压力
An investigation draws on endpoint or agent events. The team needs evidence it can inspect and an explicit boundary between an explanation, an approval and an action.
02
产品决策
Select authorized records for one bounded investigation. Preserve source context, tenant scope and collection gaps. Review the case revision, action result and recovery conditions. Production protection and live integrations require independent qualification.
03
技术记录
Import authorized event records and local Wazuh files into tenant-scoped investigations. Make collection gaps, source context and uncertainty visible. Separate the proposal, approval and execution roles, binding approval to the action digest and case revision. Current containment changes sandbox database state only. Inspect revisioned case and asset records and encrypted snapshot recovery. These source mechanisms do not establish production confidentiality or security coverage.
04
证据回流
Review the case revision, action result and recovery conditions. Production protection and live integrations require independent qualification.
访客及客户数据的 AI 处理限于通过受治理的欧盟端点使用 Mistral。所有者授权的 Helio、搜索及 Product Council 流程已启用。独立的公开来源编辑流程使用 Anthropic，并以受治理的 Mistral 作为备用；该流程不接收网站咨询、客户文档或访客对话。远程 AI 不可用时，确定性工具仍可使用。
源码证据
源码实际能够证明什么
A Rust local-lab implementation for security-event investigation, case evidence, separate analyst, approver and executor authority checked by the application, sandbox response and encrypted snapshot recovery. The research architecture extends beyond the implemented lab.
详细技术快照以英文维护。
成熟度
Rust research prototype · local lab
证据审查
源码快照截至
产品与架构决策
Keep source evidence and optional model explanation separate from permission to act.
Require separate proposal, approval and execution authority for a specifically reviewed sandbox action.
Make case revisions, uncertain outcomes and recovery conditions visible before broader integration.
可核验的证据
Rust-rendered local application, authorized event intake and checkpointed local Wazuh-file collection.
Case and asset records, action-digest and case-revision-bound approval and sandbox database-state changes.
Age-encrypted snapshot and restore implementation with recovery restrictions. Repository validation records were inspected; this website review did not execute the venture suites.
声明边界
Current containment changes sandbox database state, not endpoint, firewall, cloud or host controls. No production deployment or customer protection result is established.
The source does not establish full SIEM, EDR or DLP coverage, detection performance, independent certification or model qualification.
The active database is not encrypted by the snapshot mechanism; filesystem protection, identity, keys, retention and operational controls require separate qualification. A same-database hash chain is not an independent audit anchor.