Add environment profiler (IPB/IPOE) for agentic security workers#63
Draft
seth-goodwin wants to merge 3 commits into
Draft
Add environment profiler (IPB/IPOE) for agentic security workers#63seth-goodwin wants to merge 3 commits into
seth-goodwin wants to merge 3 commits into
Conversation
Profiles an Elastic deployment so agentic hunts run grounded in the actual environment. Scoped for single-cluster and MSSP/MDR multi-environment use. - Inventory, endpoint posture, and response/SOAR capabilities across endpoint/network/cloud/identity, plus coverage signals and field terrain - Deterministic discovery of huntable data in off-schema and ECS streams, including standalone indices and the detection-alert alias - Hybrid index classification (heuristic skeleton -> LLM confirmation -> human approval) with affordances and a signature-keyed sticky catalog - Hunt-primitive matrix, join-key fabric, and process-lineage tiers; reindex-mirror collapse and empty-stream pruning - Renders a markdown report and an interactive Cursor Canvas brief - Ships the profile-environment MCP tool, skill, docs, and tests Co-authored-by: Cursor <cursoragent@cursor.com>
…filer Extends the shared HuntIndexProfile contract so a hunt generator can emit runnable, grounded ES|QL without probing the cluster itself: - data_class (raw_event | alert | detonation | telemetry_aggregate) gates which primitives are possible per index; telemetry/detonation names win over alert-metadata fields so alert rollups classify correctly. - field_reality per hunt index: canonical->actual path resolution, ES types, nested detection (ES|QL-addressable + search_nested), multivalue + cast hints, precomputed IOC-match field lists, matched_atomic accessor, and rule metadata. Identity anchors resolve strictly, rejecting foreign-entity paths (e.g. a code signer's host.name) so missing identity routes through the join fabric. - identity_fields per hunt index: direct anchors (present + populated via a bounded ES|QL COUNT ratio probe), populated join keys, and a cross-index resolves_via fabric (agent.id -> host.name/user.name, etc.). - Terrain: primitives_supported_by_class gating table and a field_presence map so multi-index FROM lists don't error and blind-spot calls are grounded. Surfaced in the tool digest, markdown brief, and canvas. Deterministic; no LLM calls. Additive and back-compatible. Co-authored-by: Cursor <cursoragent@cursor.com>
…nment profiler
Matchability is a per-index field-shape fact: any hunt target carrying
observable fields (ip/domain/url/hash/dns) supports ioc_match and
enrichment_match. Previously these primitives were gated on the presence of an
in-cluster intel/enrichment source, so a raw-event cluster with no in-cluster TI
reported zero even though every index was fully matchable.
Now capability is derived from field shape and source availability only sets the
mode: PrimitiveSupport.source_mode ("in_cluster" self-serviced vs "byo" where the
worker supplies the indicator/enrichment feed), plus terrain-level
ioc_match_self_serviced / enrichment_self_serviced flags. Markdown gains a Mode
column and the canvas glossary notes BYO vs in-cluster.
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Profiles an Elastic deployment so agentic hunts (and other workers) run grounded in the actual environment. Scoped for single-cluster and MSSP/MDR multi-environment use.
Reference: #44