CLAUDE.md Quick Reference

Auto-generated synthesis of key operational information from CLAUDE.md

Last updated: 2026-06-28

---

Environments

Environment	Details
Azure PROD	ciriusgroup.com, tenant d477c9f8 — primary production
Azure DDE	ciriusdde.com, tenant ff1c5d68 — customer-facing AVD/published app to Medicare
AWS	7-account org — DR and services, not live production traffic

AWS Accounts

Account	ID	Purpose
Management	206820231356	Org root
bedrock-platform	863609217450	Platform account — Bedrock Hub/Orchestrator/runner (repurposed from Backup/Veeam)
Dev	040067931468	Development (minimal plumbing)
Identity	414134953818	IAM and identity
Logging	038901680748	CloudTrail, S3 archive, syslog VM
Networking	238342914131	Palo Alto firewall infrastructure
Prod	807267566999	DR workloads, Cloud PC

Repositories

Repository	Purpose
azure-infra	Azure production infrastructure
aws-infra	AWS all-account infrastructure
azure-dde-infra	DDE environment
ops-automation	Security agents, compliance pipelines
palo-alto-configs	Firewall configuration
bedrock-docs	Architecture documentation
bedrock-hub	SecOps platform (FastAPI + PostgreSQL)

Security Hard Rules (NEVER VIOLATE)

• Never terraform apply locally. All applies go through GitHub Actions CI/CD after PR merge. Local Terraform is read-only (plan, show, state list).
• Never push directly to main. Branch → PR → CI → merge. Always.
• Never suppress break-glass account activity. cirius-breakglass accounts are permanently unsuppressible. Hard API block in SecOps. Never add them to known-good rules.
• Never add ACCEPTED_RISK status in a HIPAA environment.
• Never auto-approve known-good rules. Rory is final authority. Nothing suppressed without his approval.
• Never store secrets in code. Use Key Vault (Azure) or Secrets Manager (AWS). Never commit credentials, tokens, or keys.
• Never hard-cap LAW ingestion. Inappropriate in a HIPAA environment. Use threshold alerts instead.

Architecture Principles

• Modules-first before HIPAA remediation. Bake controls into modules so resources become compliant automatically when refactored.
• Import before fixing. Get unmanaged resources into Terraform with zero diff first, then remediate in separate PRs.
• Decommission-bound resources get flat import with comment markers — don't waste time hardening things scheduled for deletion (target June 2026).
• Fail-open design. Empty arrays on API errors, not hard failures.
• source_system required on every incident payload. ioc_key must include source_system to prevent cross-environment deduplication.
• Fewer tools is better. Every GitHub Action is a trusted dependency with production credentials. SHA-pin all Actions references.
• Full auto-merge is too risky in a HIPAA environment. AI-assisted review reduces cognitive load to lightweight sign-off.

Current Priorities

1. Cloud PC migration — Ubuntu 24.04 EC2 in AWS Prod, private subnet, Twingate SSH access, SSM break-glass, Cortex XDR, auditd, Claude Code + Telegram Channels, systemd service, kobe-bot GitHub member account (not owner), kobe-sp Reader SP, instance profile ReadOnlyAccess + state S3 read
2. Kill chain Phase 1 — Enable EventID 4688 + PowerShell script block logging + 4698 via Intune (home computers) and GPO (AD-joined servers). Verify 7045/4624/ 4648/1102/5140 flowing to LAW. auditd on all Linux VMs.
3. Kill chain Phase 2 — Build 6 agents: execution, persistence, credential dumping, lateral movement, exfiltration, defense evasion. One agent per kill chain stage.
4. Orchestrator split — PROD/DDE/AWS as separate Container Apps Jobs with tuned SecurityAgent prompts per environment.

Break-Glass Accounts (CRITICAL - Never Suppress)

• cirius-breakglass@ciriusgroup.com
• cirius-breakglass@ciriusdde.com
• cirius-breakglass@dr.ciriusgroup.internal
• AWS root accounts (all 7)
• Entra PROD and DDE break-glass
• Palo Alto local admin (all 4 firewalls)

Key People

Name	Role	Responsibilities
Rory	Sole IT/security, architect	Reviews all diffs, makes all decisions
Kevin	T1 Domain Admin (DR)	Escalation path, consumes compliance reports
Greg	T1 Domain Admin (DR)	Escalation path, consumes compliance reports
Adriana	Manages BAA/vendor/risk docs	Uploads compliance docs to SharePoint

Known Technical Gotchas

• Palo Alto marketplace images don't support encryption_at_host — CMK is the compensating control
• Azure VM names are immutable (baked into resource ID, require destroy/recreate)
• AWS resources use the Name tag and can be renamed in-place with no downtime
• OIDC federated credentials require exact repository name matching: Cirius-Group-Inc not CiriusGroup
• string.Template conflicts with CSS $ signs — use with .replace() instead
• Azure Cost API end dates are inclusive; AWS Cost Explorer end dates are exclusive
• KQL hostname normalization: toupper(tostring(split(Computer, ".")[0])) to reconcile FQDN vs short hostname mismatches
• Bash subshell bug: piping into while loops loses variable modifications — use process substitution
• SES delivery: use --cli-input-json file:// with base64 for large MIME payloads
• pan_analyzer has no reliable pip package — build custom XML-parsing checks instead
• AWS Security Hub has NO HIPAA standard — use Audit Manager with HIPAA-Omnibus-Jan-2013 framework
• Soft delete + immutability (Unlocked) should be default on all Recovery Services Vaults
• MDE Sense must run in Passive Mode when Cortex XDR is active — Active Mode causes CPU saturation
• Microsoft-SecurityEvent DCR stream requires a Sentinel-enabled workspace — returns 400 InvalidPayload on non-Sentinel LAW. Microsoft-Event stream works on any LAW but lands in Event table with unparsed RenderedDescription instead of structured SecurityEvent columns. Keep SecurityEvent DCRs pointed at law-central.

---

About This Document

This quick reference is automatically generated from /CLAUDE.md (our operating instructions file) whenever it's updated. The synthesis extracts key operational data and presents it in an easily scannable format.

Updates

• Automatic: GitHub Actions workflow runs on every CLAUDE.md push to main
• Manual: Run npm run synthesize locally to regenerate
• Validation: Script verifies all critical sections are present
• Change Detection: Compares with previous version and reports detailed diffs

Key Features

• ✅ Auto-updates via CI/CD
• ✅ Validates extraction completeness
• ✅ Detects and reports changes with detailed diffs (added/removed items)
• ✅ Machine-readable JSON output at /docs/claude-synthesis.json

For implementation details, see /docs/CLAUDE_SYNTHESIS_README.md.

INFO

For complete details, refer to CLAUDE.md in the repository root.