Appearance
Infrastructure Documentation
ℹ️ The published site sidebar is generated from the filesystem and always complete; the curated tables below can lag. Auto-generated list of docs missing from these tables: Recently Added.
This repository contains operational and architectural documentation for the Cirius Group healthcare infrastructure environment. All infrastructure is managed as code using Terraform across Azure and AWS, with GitHub Actions CI/CD pipelines enforcing compliance and security scanning on every change.
Compliance scope: SOC2 · HIPAA · HITRUST
Environment Overview
| Environment | Platform | Region | Repository | Purpose |
|---|---|---|---|---|
| Primary production | Azure | US West 2 | azure-infra | Core business workloads, identity, logging |
| Customer AVD (DDE) | Azure | US West 2 | azure-dde-infra | Medicare-facing published app, isolated tenant |
| Disaster recovery | AWS | US West 2 | aws-infra | 7-account org: DR workloads, Veeam targets |
Azure Subscriptions (ciriusgroup.com, tenant d477c9f8)
| Subscription | Key Resources |
|---|---|
| Production | VMs, storage, application workloads |
| Development | Dev VMs, test databases |
| Identity | Entra domain services VMs |
| Firewall | Palo Alto VM-Series, hub VNet |
| Logging | Log Analytics (cirius-logging-law-central), Event Hub, archive storage, Defender |
| Main | OIDC federation, Key Vault, Terraform state storage |
| Dashboard | dashboard.ciriusgroup.com |
Key People
| Person | Role | Responsibilities |
|---|---|---|
| Rory | Sole IT/Security Engineer | All infrastructure decisions, PR review authority, security operations |
| Kevin | T1 Domain Admin | DR escalation, compliance reports |
| Greg | T1 Domain Admin | DR escalation, compliance reports |
| Adriana | Compliance coordinator | BAA/vendor/risk documents, SharePoint uploads |
Start Here — New Engineer Guide
If you are new to this environment, read these five documents first in order:
- Azure Infrastructure Overview — What Azure looks like: subscriptions, networking, security layers
- AWS DR Overview — The AWS disaster recovery environment: 7-account org, firewalls, failover design
- Security Monitoring Architecture — The 17-agent monitoring system, how incidents are created, the SecOps platform
- CI/CD Pipeline Overview — How every infrastructure change gets deployed
- Incident Response — What to do when something goes wrong
Then read Key Learnings — 289 lines of hard-won gotchas that will save you hours.
If you are working on the security monitoring agents (kill chain Phase 2, new detections), also read Agent Development Guide before writing any code.
If you are preparing for the SOC2 audit, start with SOC2 PBC Guide — it maps every auditor request to the exact evidence location.
Architecture & Design
Core design documents — authoritative references for how the infrastructure is structured.
| Document | Description |
|---|---|
| Network Topology | IP ranges, subnet design, firewall placement, route design — authoritative network reference |
| Security Monitoring Architecture | 17-agent system, Container Apps Jobs, incident lifecycle, agent inventory, notification rules |
| Agent Development Guide | How to build, test, and deploy a new monitoring agent — output contract, KQL patterns, kill chain agent specs, deployment |
| Two-Firewall Architecture | PublicFW/PrivateFW design principles and component overview |
| UDR Routing Design | User-Defined Route strategy — forcing spoke-to-spoke traffic through Palo Alto NVA |
| Domain Consolidation — Current State | Current AD forests, DNS zones, registrar mapping |
| Domain Consolidation — Target State | Planned identity consolidation design |
CI/CD
All infrastructure changes flow through GitHub Actions with OIDC federated authentication — no stored credentials.
| Document | Description |
|---|---|
| CI/CD Pipeline Overview | GitHub Actions pipeline stages, triggers, and authentication |
| OIDC Authentication | OIDC federated identity for GitHub Actions — Azure/AWS trust configuration |
| Checkov HIPAA Scanning | HIPAA compliance scanning in the pipeline, findings, and suppressions |
| ops-automation Overview | All scheduled automation: HIPAA audit, cost report, pen testing, Maester, Cortex XDR, PIM audit, config backup |
| Monthly Cost Reporting | Cost report schedule, pipeline architecture, and how to read and act on the report |
Azure
Primary production environment (ciriusgroup.com) and customer-facing DDE environment (ciriusdde.com).
| Document | Description |
|---|---|
| Azure Infrastructure Overview | Primary Azure environment — network topology, subscriptions, security layers |
| Azure Network Topology | Hub-spoke network architecture, VNet peering, traffic flow |
| DDE Infrastructure Overview | Customer-facing AVD environment in isolated Azure tenant (ciriusdde.com) |
| DDE Network Topology | DDE two-VNet topology, AD colocation design |
| CiriusSvcs VNet Dependencies | Legacy CiriusSvcsVNET dependency map and H2 2026 decommission blockers |
| Domain Consolidation Plan | Active identity consolidation project plan |
| WRKBIZAP01 Migration Plan | Payer API server migration plan |
AWS
Seven-account organization used for disaster recovery and services. Not primary production traffic.
Account Structure
| Account | ID | Purpose |
|---|---|---|
| Management | 206820231356 | Org root |
| Backup | 863609217450 | Veeam backup targets |
| Dev | 040067931468 | Development |
| Identity | 414134953818 | IAM and identity |
| Logging | 038901680748 | CloudTrail, S3 archive, syslog VM |
| Networking | 238342914131 | Palo Alto firewall infrastructure |
| Prod | 807267566999 | DR workloads, Cloud PC |
| Document | Description |
|---|---|
| AWS DR Overview | DR environment architecture, 7-account org, firewall/Panorama, MDR coverage |
| AWS Network Topology | Transit Gateway hub-spoke, VPC isolation model |
| DR Failover Procedure | Step-by-step Azure → AWS failover instructions |
| DR Failback Procedure | Failback procedure — placeholder, pending June 2026 DR test |
Security
Firewall & Network Security
| Document | Description |
|---|---|
| Palo Alto Firewall Overview | Firewall architecture, security zones, Panorama status, syslog infrastructure |
| Panorama Operations Guide | Disk sizing, log forwarding, PAN-OS upgrade procedure, SCP workaround |
| Firewall Change Request Procedure | Formal change classification, approval, implementation, and documentation process |
| Palo Alto Config Backup & Audit | Automated config backup, log forwarding architecture, weekly security audit |
| Palo Alto Credential Rotation | Backup credential rotation procedure for all 4 firewalls |
| Firewall Rule Reference | Firewall rule governance and operational change runbook |
| Network Segmentation — Communication Map | Allowed inter-segment communication matrix |
| Network Segmentation — Proposed Rules | Proposed NSG/firewall rule changes |
EDR, MDR & Endpoint
| Document | Description |
|---|---|
| EDR — Cortex XDR | Cortex XDR coverage, MDE Passive Mode requirement, agent deployment |
| Arctic Wolf MDR — Scope Gap Analysis | MDR coverage gaps and remediation status |
| Patch Management | Patch cadence, approval workflow, emergency patch procedure |
| Penetration Testing | Monthly pen test scope, tools (Nuclei + Nmap), results interpretation |
| Velociraptor Architecture Evaluation | DFIR tool evaluation for on-demand artifact collection |
| Vulnerability Management | Automated vulnerability notification system (Lambda, S3, SES) |
Identity & Access Control
| Document | Description |
|---|---|
| Three-Layer Access Architecture | ZTNA (Twingate) + Entra Conditional Access + Intune compliance — the full access model |
| DDE Privileged Access Review | DDE tenant privileged access audit |
| DDE Subscription Security Controls | Security controls applied to the DDE Azure subscription |
| Least Privilege Baseline | Principle of least privilege baseline across all systems |
| Least Privilege — ops-automation | Least privilege analysis for ops-automation agents |
| Least Privilege — SecOps | Least privilege analysis for SecOps platform |
| Privileged Role Cleanup (PROD) | Privileged role reduction in the production tenant |
| Credential Exceptions | Documented exceptions to the no-long-lived-credentials policy |
| Unavoidable Long-Lived Secrets | Secrets that cannot be rotated to managed identity — documented with compensating controls |
| Secrets & Managed Identity Evaluation | Decision analysis for migrating service secrets to managed identity |
| Graph API Certificate Auth Evaluation | Evaluation of certificate-based Graph API authentication |
Email & DNS Security
| Document | Description |
|---|---|
| DMARC Enforcement Plan | DMARC policy progression to enforcement across both tenants |
| DNSSEC Feasibility | DNSSEC implementation feasibility analysis |
| CiriusSupport Email Security | Email security controls for the support address |
Threat Model
| Document | Description |
|---|---|
| Threat Model | Living threat model — crown jewels, threat actors, STRIDE analysis, controls mapped to kill chain. Start here for security context. |
| Kill Chain Coverage | Per-stage detection coverage map — what is detected, what has gaps |
| Crown Jewel Inventory | Formal crown jewel asset list |
| Maester M365 Audit Guide | Maester test categories, scoring interpretation, remediation priority |
| Maester M365 Security Audit | Weekly Maester audit results and remediation tracks |
Deception & Canary
| Document | Description |
|---|---|
| Deception Layer | Canary token and honeypot architecture — what is deployed and where |
| Canary Token Inventory | Active canary tokens: names, locations, alert routing |
CMDB & Inventory
| Document | Description |
|---|---|
| CMDB Guide | What is in the CMDB, how it is maintained, how agents use it |
| Terraform Standards | Security-layer Terraform coding standards |
Runbooks
Incident Response & Security Operations
| Document | Description |
|---|---|
| Incident Response | Step-by-step response for ransomware, breaches, outages — incorporates November 2024 lessons |
| Alerting Runbook | Alert sources, routing, severity levels, escalation paths |
| Out-of-Band Communications Plan | How to communicate when primary channels are compromised |
| Break-Glass Procedure | Emergency break-glass account activation for all 18 accounts — when to use, step-by-step per system |
| SecOps Platform Guide | How to use secops.bedrockcybersecurity.org — incident triage, known-good rules, troubleshooting, deployment |
| Admin Account Hygiene | Administrative account standards and periodic hygiene checks |
| Monthly Security Review | Monthly security review checklist and procedure |
| Monthly Threat Hunt Scope | Monthly threat hunt hypothesis framework, KQL queries, evidence retention |
| Kill Chain Audit Policy | Windows audit policy configuration enabling kill-chain detection (EventID 4688, 4698, etc.) |
Arctic Wolf (MDR)
| Document | Description |
|---|---|
| Arctic Wolf Health Check | Weekly MDR health check — agent connectivity, log ingestion, alert queue |
| Arctic Wolf Ingestion Validation | Verify Arctic Wolf is receiving all required log sources |
| Arctic Wolf CMDB Check | Reconcile Arctic Wolf device inventory against CMDB |
| Arctic Wolf AWS Connector | AWS log connector setup and troubleshooting |
| Arctic Wolf OneLogin Connector | OneLogin integration setup for Arctic Wolf |
Backup & Disaster Recovery
| Document | Description |
|---|---|
| Backup Architecture | Azure Recovery Services Vault, Veeam DR replication, DDE vault coverage, validation |
| Veeam Restore Procedure | How to actually recover data — RSV file/VM/SQL restore, Veeam DR to AWS, Glacier recovery, restore decision tree |
| Offline Backup Procedure | Air-gapped backup procedure — when and how to create offline copies |
| DR Test Checklist | Pre/during/post DR test checklist |
| BGKIT DR Checklist Note | Business continuity kit DR checklist notes |
| Annual BGKIT Verification | Annual business continuity kit verification procedure |
Intune & Device Management
| Document | Description |
|---|---|
| Intune MAM Mobile | Mobile Application Management policy — what is enforced on mobile devices |
| Intune Non-Compliance Investigation | How to investigate non-compliant devices and restore compliance |
| Intune Orphaned Devices | Finding and cleaning up orphaned device records |
| Intune USB Storage Block | USB storage blocking policy configuration |
| DDE ASR Configuration | Attack Surface Reduction rule configuration for the DDE environment |
System Maintenance
| Document | Description |
|---|---|
| Common Infrastructure Tasks | Routine operations — server management, firewall changes, certificate rotation |
| Twingate Operations Guide | Adding users and resources, troubleshooting access, connector health check, outage procedure |
| Twingate Compliance Enforcement | Enforcing device compliance certificates for Twingate access |
| Twingate Connector IPs | Connector IP inventory and firewall allowlist |
| Cloud PC Rebuild | Kobe Cloud PC (AWS EC2 Ubuntu) rebuild procedure from scratch |
| Cloudflare Terraform Integration | Cloudflare DNS and WAF management via Terraform |
| Velociraptor Operations | Velociraptor DFIR agent deployment and artifact collection |
| Ultra Disk Evaluation | Azure Ultra Disk evaluation for high-IOPS workloads |
| BIZFTPAZP01 Stale Credentials | Stale credential remediation on the BIZFTPAZP01 server |
Recurring Cadence
| Document | Description |
|---|---|
| Annual Communications Test Schedule | Annual schedule for testing all communication channels |
| Quarterly Service Principal Cleanup | Quarterly cleanup of expired or unused service principals |
| Quarterly SP Permission Review | Quarterly service principal permission audit |
| Post-Cleanup Drift Verification | Verifying no configuration drift after a cleanup cycle |
| Year-End Checklist | Annual year-end security and compliance review checklist |
Active Projects & Migration Work
| Document | Description |
|---|---|
| Dashboard Migration Plan | dashboard.ciriusgroup.com migration plan |
| iMacros Migration Scope | Scope and plan for retiring iMacros automation |
| June 2026 Decommission Checklist | Resources scheduled for decommission by June 2026 |
Compliance
SOC2 Audit Readiness
| Document | Description |
|---|---|
| SOC2 PBC Guide | Provided By Client guide — maps every common auditor request to exact evidence location. Start here for the September 2026 audit. |
| HIPAA Risk Assessment | Formal §164.308(a)(1)(ii)(A) risk assessment — 7 risks with likelihood × impact scoring, residual scores, treatment plan, acknowledgment |
| Training Completion Log | Who completed what training and when — KnowBe4, HIPAA, IR tabletop, phishing sims. Update within 5 days of each event. |
| Emergency Mode Operation Plan | §164.308(a)(7)(ii)(C) — what continues during an outage, who decides, minimum security controls, communication plan |
| Pen Test Results Log | Monthly scan results tracker — finding severity, SLAs, open findings, false positives, auditor evidence package instructions |
Frameworks & Core Controls
| Document | Description |
|---|---|
| HIPAA Controls Matrix | Complete mapping of infrastructure controls to HIPAA requirements |
| HIPAA Administrative Procedures | Six HIPAA safeguard procedures: risk management, sanction policy, workforce training, incident procedures, contingency planning, evaluation |
| HIPAA Policy Set | Full policy framework documents — information security, acceptable use, data classification |
| Logging Architecture | Dual logging system (hot/SIEM/archive), all log sources wired, 6-year WORM archive |
| Tagging Standard | Terraform naming conventions and required tags for all resources |
| Compliance Scorecard | Current compliance posture across SOC2/HIPAA/HITRUST — control scores and gaps |
Audit Evidence
| Document | Description |
|---|---|
| Least Privilege — CI/CD Audit | Evidence: CI/CD pipeline least-privilege assessment |
| Least Privilege — ops-automation Audit | Evidence: ops-automation agents least-privilege assessment |
| Least Privilege — SecOps Audit | Evidence: SecOps platform least-privilege assessment |
| Least Privilege — Evidence Mapping | Evidence traceability: least-privilege controls → HIPAA/SOC2 requirements |
| VPNLYR Audit Evidence | HIPAA/SOC2 control mapping evidence for Twingate ZTNA layer |
| Annual Review Checklist | Annual security review checklist for SOC2/HIPAA |
| Keeper License Audit | Keeper password manager license audit and user reconciliation |
Risk Management
| Document | Description |
|---|---|
| Risk Acceptance Register | Formal log of accepted risks — all items require Rory approval |
| Cyber Insurance Review Checklist | Annual cyber insurance renewal checklist |
| IR Retainer Evaluation | Incident response retainer vendor analysis |
| Vendor PHI Inventory | All vendors that handle PHI — BAA status, data flows |
| Vendor Risk Inventory | Third-party vendor risk assessments |
IR Tabletop
| Document | Description |
|---|---|
| IR Tabletop Scenario 2026 | 2026 tabletop exercise scenario (ransomware) |
| IR Tabletop Coordination | Logistics, participant roles, facilitation guide |
| IR Tabletop Findings Template | Structured findings template for post-exercise documentation |
DR Testing
| Document | Description |
|---|---|
| Q2 2026 DR Test Plan | Q2 2026 scheduled DR test plan — Azure → AWS failover validation |
| Q4 2026 DR Test Plan | Q4 2026 DR test plan |
| Q3 Enforce Mode Review | Q3 review of Purview DLP and Intune enforce mode rollout |
Access Control & Privileged Access
| Document | Description |
|---|---|
| Three-Layer Access Architecture | ZTNA + Entra + Intune — full access control model and compliance mapping |
| Access Control Review | Periodic access control review procedure and evidence |
| PIM Exclusion List | Accounts excluded from PIM enforcement — all require justification |
| PAM Evaluation | Privileged Access Management solution evaluation |
| PAM Scope | PAM scope definition — what accounts and systems are in scope |
| Purview DLP Enforce Mode Criteria | Criteria required before moving DLP policies to Enforce mode |
| Onboarding Security Checklist | New employee security provisioning checklist |
Training & Awareness
| Document | Description |
|---|---|
| Security Awareness Training Evaluation | Training program vendor evaluation and selection |
| Phishing Simulation Schedule | Monthly phishing simulation campaign schedule and metrics |
Database
| Document | Description |
|---|---|
| MySQL Server Setup | MySQL installation, configuration, and maintenance procedures |
Threat Hunting
| Document | Description |
|---|---|
| Hunt 001 — Baseline Threat Hunt | First formal threat hunt: hypothesis, KQL queries, evidence template. Also serves as the template for future hunts. |
Key Learnings
| Document | Description |
|---|---|
| Key Learnings | 289 lines of infrastructure gotchas and hard-won lessons — Palo Alto quirks, Azure limitations, AWS behavior differences, KQL normalization, Terraform pitfalls. Read this before troubleshooting anything. |
Infrastructure Tools
| Tool | Purpose |
|---|---|
| Terraform | Infrastructure as code across Azure and AWS |
| GitHub Actions | CI/CD pipeline orchestration |
| Checkov | HIPAA compliance scanning (IaC layer) |
| Trivy | Container image vulnerability scanning |
| Azure Policy | Runtime compliance monitoring (Azure) — HIPAA/HITRUST + ISO 27001 |
| AWS Security Hub | Runtime compliance monitoring (AWS) — NIST 800-53 R5 |
| AWS Audit Manager | Continuous HIPAA Omnibus assessment (all 7 accounts) |
| Palo Alto VM-Series | Network traffic inspection and zone enforcement (4 firewalls) |
| Panorama | Centralized firewall management and log aggregation |
| Arctic Wolf MDR | Active security monitoring — VLC active across all 4 firewalls, act-first authority |
| Cortex XDR | EDR on all Windows VMs and managed devices |
| Maester | Weekly M365 security testing — both tenants |
| Nuclei + Nmap | Monthly automated penetration testing |
| Twingate | Zero-trust network access (primary remote access) |
| GlobalProtect | VPN access (CEO/CTO only) |
| Intune | Device management and compliance enforcement |
| Keeper | Password management |
| Azure Container Apps Jobs | Agent runtime for the 17-agent security monitoring system |
| Azure OpenAI (gpt-4o) | LLM inference for SecurityAgent and Detection Agent |
Recently Added Docs (auto-generated)
Docs present in the repo but not yet placed in the curated tables above. Regenerate with the one-liner in this section's comment. Last generated: 2026-06-10.
Autonomous Builds
Some changes in this repo are produced autonomously by the Bedrock Orchestrator and opened as PRs for human review.
Document History
| Date | Change | Author |
|---|---|---|
| May 2026 | Comprehensive index rewrite: added Architecture section (6 docs), expanded Security to 9 subsections (30+ docs), expanded Runbooks to 6 subsections (40+ docs), expanded Compliance to 7 subsections (30+ docs), added Threat Hunting section, added Key Learnings, added New Engineer Guide. Total indexed: 131 docs. Added New Engineer Start Here guide. | Rory |
| March 2026 | Added new docs: Panorama Operations Guide, Firewall Change Request Procedure, Maester M365 Audit Guide, Penetration Testing, Monthly Cost Reporting. Updated 7 existing docs. | Rory |
| March 2026 | Added ops-automation-overview.md, palo-alto-config-backup.md, alerting-runbook.md; updated backup-architecture.md; fixed OIDC auth doc | Rory |
| February 2026 | Initial draft | Rory |
Runner e2e validated 2026-06-25.