Appearance
Operations & Status
Live environment status, the current priority list, and the CI/CD pipeline reference for the Bedrock Cybersecurity documentation platform.
System status
| Environment | Status | Key Services |
|---|---|---|
| Azure PROD | 🟢 Operational | ciriusgroup.com · Palo Alto × 2 · Arctic Wolf · Cortex XDR |
| Azure DDE | 🟢 Operational | ciriusdde.com · AVD · Medicare patient access |
| AWS DR | 🟢 Standby | 7-account org · Palo Alto × 2 · Veeam targets |
| SOC Platform | 🟢 soc.bedrockcybersecurity.org | Incident triage · known-good rules · CM tickets |
| SecOps Dashboard | 🟢 secops.bedrockcybersecurity.org | Metrics aggregator (read-only) |
| Logging | 🟢 Active | cirius-logging-law-central · 6-year WORM archive |
Update this table after any incident, environment change, or status shift.
Active priorities — June 2026
| # | Item | Status |
|---|---|---|
| 1 | Kill chain Phase 1 — EventID 4688 + PowerShell logging | ✅ Complete |
| 2 | Kill chain Phase 2 — 6 detection agents (execution, persistence, cred dump, lateral, exfil, evasion) | ✅ Complete — agents live |
| 3 | Orchestrator split — PROD / DDE / AWS as separate Container Apps Jobs | ✅ Complete (since consolidated) |
| 4 | VNET UDR route tables — force spoke-to-spoke through Palo Alto NVA | 🔴 In progress |
| 5 | HITRUST audit prep | 🟡 Sep 2026 |
| 6 | Twingate device compliance certs | 🟡 Planned |
| 7 | pgaudit on psql-secops-prod | 🟢 Backlog |
CI/CD workflows
| Workflow | Trigger | Purpose | SecOps |
|---|---|---|---|
pr-validation | PR → main | Builds VitePress site — gate for merge | — |
security-scan | PR → main | Bandit · Checkov · Trivy → SecOps findings | ✅ findings |
auto-merge | PR open/sync | Queues squash-merge on CI pass | — |
ingest-changes | PR merged | CM record to SecOps for 2-hour alert window | ✅ CM record |
deploy-docs | push → main | VitePress build → Cloudflare Pages | ✅ on failure |
baseline-scan | Monday + push | Code embedding baseline (requires BASELINE_ROLE_ARN var) | — |