Docs

Appearance

Kobe Operating Instructions ​

This document synthesizes the operational patterns, technical standards, and security principles that guide infrastructure work at Cirius Group. These instructions are derived from CLAUDE.md and represent battle-tested patterns from production incidents and compliance audits.

Working Pattern ​

  1. Read before writing. Always read existing files before modifying them. Understand the pattern before extending it.
  2. Show before applying. Present complete diffs for review. Never terraform apply without explicit approval. Never push directly to main.
  3. PR everything. Create a branch, make changes, open a PR. CI runs Checkov and terraform plan on every PR. The merge triggers deploy.
  4. Ask when uncertain. If a decision has architectural implications, stop and ask rather than guessing.
  5. Surgical over broad. Targeted changes over sweeping rewrites. One concern per PR where possible.
  6. Parallel where safe. Run independent workstreams simultaneously when they don't touch the same files.
  7. Single-line commands only. Multiline commands fail in this environment. Always provide single-line versions of shell commands.

Environment Overview ​

Cloud Environments ​

EnvironmentDetails
Azure PRODciriusgroup.com, tenant d477c9f8 — primary production
Azure DDEciriusdde.com, tenant ff1c5d68 — customer-facing AVD/published app to Medicare
AWS7-account org — DR and services, not live production traffic

AWS Accounts ​

AccountIDPurpose
Management206820231356Org root
bedrock-platform863609217450Platform account — Bedrock Hub/Orchestrator/runner
Dev040067931468Development (minimal plumbing)
Identity414134953818IAM and identity
Logging038901680748CloudTrail, S3 archive, syslog VM
Networking238342914131Palo Alto firewall infrastructure
Prod807267566999DR workloads, Cloud PC

Key Infrastructure ​

  • Firewalls: 4x Palo Alto VM-Series, Panorama management, DNS Security live and blocking
  • EDR: Cortex XDR on all Windows VMs and managed devices
  • MDR: Arctic Wolf — agent on all managed devices, full Azure access, act-first without approval
  • Remote access: Twingate (primary), GlobalProtect (CEO/CTO only)
  • Monitoring: 17-agent security monitoring system, 4-hour cycles, Container Apps Job
  • SecOps platform: secops.bedrockcybersecurity.org — FastAPI, PostgreSQL psql-secops-prod, Container App ca-secops-prod in rg-logging-logs
  • Log Analytics: cirius-logging-law-central (ID: 5d76d1f2, rg-logging-logs, logging subscription)
  • Container registry: ciriusagentsprod.azurecr.io
  • Key Vault: cirius-openai-kv-prod
  • Azure OpenAI: gpt-4o at cirius-openai-prod.openai.azure.com

Security Principles — Never Violate These ​

Hard Rules ​

  • Never terraform apply locally. All applies go through GitHub Actions CI/CD after PR merge. Local Terraform is read-only (plan, show, state list).
  • Never push directly to main. Branch → PR → CI → merge. Always.
  • Never suppress break-glass account activity. cirius-breakglass accounts are permanently unsuppressible. Hard API block in SecOps. Never add them to known-good rules.
  • Never add ACCEPTED_RISK status in a HIPAA environment.
  • Never auto-approve known-good rules. Rory is final authority. Nothing suppressed without his approval.
  • Never store secrets in code. Use Key Vault (Azure) or Secrets Manager (AWS). Never commit credentials, tokens, or keys.
  • Never hard-cap LAW ingestion. Inappropriate in a HIPAA environment. Use threshold alerts instead.

Architecture Principles ​

  • Modules-first before HIPAA remediation. Bake controls into modules so resources become compliant automatically when refactored.
  • Import before fixing. Get unmanaged resources into Terraform with zero diff first, then remediate in separate PRs.
  • Decommission-bound resources get flat import with comment markers — don't waste time hardening things scheduled for deletion.
  • Fail-open design. Empty arrays on API errors, not hard failures.
  • source_system required on every incident payload. ioc_key must include source_system to prevent cross-environment deduplication.
  • Fewer tools is better. Every GitHub Action is a trusted dependency with production credentials. SHA-pin all Actions references.
  • Full auto-merge is too risky in a HIPAA environment. AI-assisted review reduces cognitive load to lightweight sign-off.

Known Technical Gotchas ​

  • Palo Alto marketplace images don't support encryption_at_host — CMK is the compensating control
  • Azure VM names are immutable (baked into resource ID, require destroy/recreate)
  • AWS resources use the Name tag and can be renamed in-place with no downtime
  • OIDC federated credentials require exact repository name matching: Cirius-Group-Inc not CiriusGroup
  • Azure Cost API end dates are inclusive; AWS Cost Explorer end dates are exclusive
  • KQL hostname normalization: toupper(tostring(split(Computer, ".")[0])) to reconcile FQDN vs short hostname mismatches
  • Bash subshell bug: piping into while loops loses variable modifications — use process substitution
  • SES delivery: use --cli-input-json file:// with base64 for large MIME payloads
  • AWS Security Hub has NO HIPAA standard — use Audit Manager with HIPAA-Omnibus-Jan-2013 framework
  • Soft delete + immutability (Unlocked) should be default on all Recovery Services Vaults
  • MDE Sense must run in Passive Mode when Cortex XDR is active — Active Mode causes CPU saturation
  • Microsoft-SecurityEvent DCR stream requires a Sentinel-enabled workspace — returns 400 InvalidPayload on non-Sentinel LAW. Microsoft-Event stream works on any LAW but lands in Event table with unparsed RenderedDescription instead of structured SecurityEvent columns. Keep SecurityEvent DCRs pointed at law-central.

Terraform Standards ​

Naming Convention ​

<env>-<service>-<resource>-<location>
Examples: cirius-logging-law-central, rg-logging-logs, ca-secops-prod

Required Tags (all resources) ​

hcl
tags = {
  Environment = "prod"          # prod | dde | dr | dev
  Owner       = "infrastructure"
  Project     = "cirius-group"
  ManagedBy   = "terraform"
  Lifecycle   = "permanent"     # permanent | decommission
}

Module Usage ​

Always use established modules rather than raw resources:

  • windows-server for all Windows VMs in azure-infra
  • vnet for all VNets
  • nsg for all NSGs
  • recovery-vault for all RSVs
  • keyvault-cmk for Key Vaults requiring CMK
  • diagnostic-settings for all diagnostic configurations
  • hipaa-log-archive for archive storage
  • vpc-spoke for AWS VPCs

Compliance Defaults ​

Every resource must have:

  • Diagnostic settings forwarding to cirius-logging-law-central
  • Encryption at rest (CMK where supported)
  • Soft delete and immutability on Recovery Services Vaults
  • No public endpoints unless explicitly required
  • NSG flow logs enabled

State Files ​

Terraform state lives in Azure Storage (azure-infra, azure-dde-infra) and AWS S3 (aws-infra). Never manipulate state directly without explicit instruction. Use terraform state mv for refactoring, never edit state files manually.

CI/CD Pipeline ​

All three infra repos use GitHub Actions with OIDC federated authentication — no stored credentials in GitHub secrets.

Infra Repo PR Workflow (azure-infra / aws-infra / azure-dde-infra) ​

  1. Create branch, make changes, open PR
  2. CI runs: terraform fmt check → terraform validate → Checkov HIPAA scan → terraform plan
  3. Plan output posted as PR comment
  4. Review diff and plan
  5. Merge triggers terraform apply via OIDC

OIDC Identity ​

  • GitHub org: Cirius-Group-Inc (exact — OIDC breaks with any other name)
  • Azure role: github-deploy-main per subscription
  • AWS role: github-deploy-main per account

Change Management ​

Every merged PR auto-creates a CM ticket in SecOps via POST /api/changes. SecurityAgent checks for CM tickets before raising incidents — approved CM within 2-hour window suppresses related alerts.

SecOps Platform ​

URL: secops.bedrockcybersecurity.org
Stack: FastAPI + Jinja2 + PostgreSQL + Azure Container Apps

API Authentication ​

  • Browser: Azure AD SSO via MSAL PKCE
  • Machine-to-machine: X-API-Key header (stored in Key Vault)
  • Fail-open: if SecOps is unreachable, agents raise alerts and skip suppression checks

Key Endpoints ​

POST /api/incidents          — SecurityAgent creates incidents
POST /api/ingest/findings    — ops-automation bulk upsert findings
GET  /api/known-good         — agents fetch suppression rules on startup
POST /api/known-good/{id}/hit — agents report rule matches (fire-and-forget)
POST /api/changes            — GitHub Actions create CM tickets
GET  /api/changes/recent     — SecurityAgent CM suppression check
GET  /api/maintenance/active — SecurityAgent maintenance window check
POST /api/evidence           — pipelines register audit evidence after S3 upload

Incident Lifecycle ​

NEW → OPEN (analyst confirms real) or CLOSED (matches known-good rule)
OPEN → INVESTIGATING → RESOLVED

Known-Good Rules ​

DB-driven, agents fetch on startup. Hit counters increment fire-and-forget. Rory is final authority — nothing suppressed without his approval. Break-glass accounts are permanently unsuppressible at API level.

Security Monitoring Agents ​

Architecture ​

17 agents in Container Apps Job, 4-hour cycles. Each mini-agent posts findings, SecurityAgent makes incident determination. Analyst agent (rules engine, no LLM) runs second — moves NEW to CLOSED (known-good match) or OPEN (no match). Detection agent enriches OPEN tickets with LLM triage.

Agent Folders ​

agents/
  entra/         — identity and Entra audit
  network/       — Palo Alto CEF, DNS, firewall
  aws/           — CloudTrail, Security Hub, IAM
  cortex/        — Cortex XDR
  supply_chain/  — GitHub Actions SHA pinning
  operational/   — backup, VM status, log retention, certs
  inventory/     — CMDB sync

Source Systems ​

Every incident must be stamped with source_system:

  • PROD — Azure production
  • DDE — Azure DDE
  • AWS — AWS all accounts

Orchestrator Jobs ​

Jobs configured in azure-infra/logging/secops_cirius.tf:

  • job-orchestrator-cirius — main incident pipeline, PROD + DDE + AWS + workstations, 4hr
  • job-mini-orchestrator-cirius — rapid-response checks, every 5 min
  • job-secops-maintenance-cirius — daily posture checks, 07:00 UTC

Notification Rules ​

  • Email every run (heartbeat)
  • Telegram only when SecurityAgent decides something is urgent
  • Telegram is read-only — no buttons, no actions
  • All approvals in SecOps app only

Kill Chain Detection — Ransomware Workstream ​

The highest-priority security initiative. Goal: trip wire at every stage of a ransomware attack so no attacker can move from initial access to encryption without triggering an alert.

Kill Chain Stages and Detection ​

StageKey EventsCurrent Status
1. Initial AccessSignInLogs, Twingate_CL, firewall hitsCOVERED
2. Execution4688 process creation, PowerShell 4103/4104GAP — needs 4688
3. Persistence7045 new service, 4698 scheduled task, FIM registryPARTIAL
4. Credential Dump4688 LSASS access, multi-target authGAP — needs 4688
5. Lateral Movement4624/4648 logon chains, 5140 admin sharesPARTIAL
6. ExfiltrationPalo Alto traffic, App-ID, DNS SecurityPARTIAL
7. Defense Evasion1102 log cleared, Cortex silencePARTIAL
8. EncryptionFIM alerts, Cortex behavioralPARTIAL

Kill Chain Agent Specs ​

Execution agent — watches 4688 for mimikatz, cobalt, mshta, wscript, rundll32 spawning from unexpected parents; processes executing from temp/AppData/user profile. Fires CRITICAL immediately, no analyst triage.

Persistence agent — EventID 7045 new service, 4698 new scheduled task, FIM registry run keys. Any new persistence outside CM window = HIGH.

Credential dumping agent — 4688 showing LSASS access, multiple failed then successful auth against multiple targets. Fires CRITICAL.

Lateral movement agent — same account hitting 3+ machines in 30 minutes, 4648 explicit creds workstation-to-server, 5140 admin share access (C$, ADMIN$). Fires CRITICAL.

Exfiltration agent — outbound bytes vs baseline, new destinations not seen in 30 days, App-ID identifying RClone/WinSCP/Mega.nz, large transfers outside business hours. Fires HIGH.

Defense evasion agent — 1102 log cleared = CRITICAL immediately. Cortex returning 0 findings while other agents elevated = HIGH. Security tool process termination. Fires CRITICAL.

Compliance Requirements ​

  • Frameworks: HIPAA, HITRUST, SOC2
  • Azure Policy: HIPAA/HITRUST and ISO 27001 assigned on all subscriptions both tenants
  • AWS: Security Hub org-wide NIST 800-53 R5, Audit Manager HIPAA Omnibus
  • Log retention: 6-year SIEM-independent archive (blob storage + S3 with WORM)
  • Break-glass accounts (18 total): On-prem AD (3), AWS root (7), Entra PROD (2), Entra DDE (2), Palo Alto (4 firewalls) — any activity = CRITICAL, no suppression ever

Key People ​

PersonRoleNotes
RorySole IT/security, architectReviews all diffs, makes all decisions
KevinT1 Domain Admin (DR)Escalation path, consumes compliance reports
GregT1 Domain Admin (DR)Escalation path, consumes compliance reports
AdrianaManages BAA/vendor/risk docsUploads compliance docs to SharePoint

Important Accounts and Resources ​

Break-Glass Accounts (NEVER touch, NEVER suppress) ​

Key Resource IDs ​

  • Central LAW workspace ID: 5d76d1f2
  • SecOps Entra group: ffdf1dcb
  • Teams bot App ID: 7a3ea16d
  • SecOps Container App: ca-secops-prod in rg-logging-logs (logging subscription)
  • PostgreSQL: psql-secops-prod

Terraform State Locations ​

  • azure-infra: Azure Storage in prod subscription
  • aws-infra: S3 in each account
  • azure-dde-infra: Azure Storage in DDE subscription
  • ops-automation: Azure Storage
  • bedrock-hub: Azure Storage

Internal use only — Cirius Group