Monitors Akamai perimeter for bot activity. Detects and blocks malicious bots targeting DANA infrastructure.
Sources
Akamai SIEM APIEdgeGrid auth
Actions
Bot detectionIP blockingRate limiting analysis
Outputs
Bot hit reportsSuspicious IP lists
Pipeline
synthesis
Schedule
0 * * * *
Advanced threat hunter querying Microsoft Defender for Endpoint (MDE). Hunts for malware, suspicious processes, and lateral movement across the fleet.
Sources
MDE Advanced Hunting APIDeviceProcessEventsDeviceNetworkEvents
Actions
KQL queriesProcess ancestry analysisNetwork connection tracing
Outputs
Threat hunt reportsIOC listsInvestigation timelines
Pipeline
synthesis
Schedule
*/30 * * * *
Central synthesis hub. Reads findings from all agents, correlates alerts, and writes consolidated synthesis reports. Provides feedback to each agent.
last run failed: RuntimeError: content_policy_blocked: model declined (content_filter)
Sources
All agent outboxesKanban board
Actions
Alert correlationCross-agent synthesisFeedback generation
Outputs
Synthesis reportsAgent feedbackAlert summaries
Pipeline
perimetermde-hunterxcorrshadow-aicred-auditosintvulnenrichdlpphish-intelapi-audittrendpipelinemeta
Schedule
10 * * * *
External surface reconnaissance. Discovers subdomains, exposed services, and changes in DANA's external attack surface.
Sources
Passive DNSCertificate transparency logsWeb scraping
Actions
Subdomain discoveryService fingerprintingChange detection
Outputs
Surface change reportsNew subdomain alerts
Pipeline
synthesis
Schedule
0 6 * * *
Daily watchdog that checks all agent health, cron job status, and agent-comm pipeline integrity. Generates morning health report.
Sources
Healer health DBCron jobsAgent outboxes
Actions
Health verificationPipeline integrity checkDaily report generation
Outputs
Daily health reportPipeline status
Pipeline
healmeta
Schedule
0 0 * * *
Shadow AI hunter. Detects unauthorized AI tool usage across the fleet - Cursor, Codex, Claude Code, LiteLLM proxies, and unauthorized AI gateways.
Sources
MDE Advanced HuntingDeviceProcessEventsNetwork events
Actions
LiteLLM proxy detectionCursor/Codex usage analysisAPI key exposure scanning
Outputs
Shadow AI sweep reportsUser activity timelinesRisk assessments
Pipeline
synthesissoc-alerts
Schedule
0 1 * * 1
Credential auditor. Audits credential leaks, plaintext credentials in configs, and exposed secrets across the fleet.
Sources
MDE Advanced HuntingFile scanning
Actions
Credential leak detectionConfig file auditSecret scanning
Outputs
Credential audit reportsExposed credential alerts
Pipeline
synthesis
Schedule
0 4 * * *
External OSINT gathering. Collects open source intelligence on DANA infrastructure, employees, and threat actors.
Sources
OSINT toolsSocial mediaDark web monitoring
Actions
OSINT collectionThreat actor profilingExposure assessment
Outputs
OSINT reportsExposure assessments
Pipeline
synthesis
Schedule
0 2 * * 1
Vulnerability scanner. Scans external services for vulnerabilities using Nuclei, Nmap, and custom checks.
Sources
Nuclei templatesNmap scansCustom vulnerability checks
Actions
Vulnerability scanningCVE verificationExposure assessment
Outputs
Vulnerability reportsCVE impact assessments
Pipeline
synthesis
Schedule
0 10 * * 2,4
Threat intel enrichment. Deep-dives on ATO attempts, phish-lane cases, and intel leads routed by Synthesis Hub, cross-referenced with MDE and Entra ID. (Cyberint feed retired 2026-09-08; GroupIB planned.)
Sources
MDE Advanced HuntingEntra IDSynthesis Hub routing
Actions
Threat enrichmentContext correlationPriority scoring
Outputs
Enriched threat reportsPriority alerts
Pipeline
synthesis
Schedule
0 8 * * *
Phishing intelligence. Monitors phishing reports, analyzes phishing campaigns, and tracks phishing infrastructure.
Sources
Phishing reportsEmail security gatewayURL scanning
Actions
Phishing campaign analysisInfrastructure trackingIOC extraction
Outputs
Phishing intel reportsIOC lists
Pipeline
synthesis
Schedule
0 1 * * *
Phishing site investigation. Investigates reported phishing websites, determines takedown status, and documents findings.
Sources
Phishing URLsWHOISSSL certificate dataWeb scraping
Actions
Site investigationTakedown trackingEvidence collection
Outputs
Investigation reportsTakedown status
Pipeline
synthesis
Schedule
0 2,14 * * *
Gateway vulnerability monitor. Monitors DANA AI Gateway for vulnerabilities, misconfigurations, and unauthorized access.
Sources
DANA AI Gateway APIGateway logsNetwork monitoring
Actions
Gateway health checkVulnerability scanningAccess pattern analysis
Outputs
Gateway security reportsVulnerability findings
Pipeline
synthesis
Schedule
0 12 * * 3
Weekly trend analysis agent. Reads all agent outboxes, identifies trends, recurring patterns, and provides strategic recommendations.
Sources
All agent outboxesHistorical findings
Actions
Trend analysisPattern recognitionStrategic recommendations
Outputs
Weekly trend reportsStrategic recommendations
Pipeline
synthesis
Schedule
0 8 * * 1
Meta-controller that correlates findings across all agents. Identifies cross-agent patterns, kill chains, and systemic issues.
Sources
All agent outboxesHealer health DBKanban board
Actions
Cross-agent correlationKill chain analysisSystemic issue detection
Outputs
Correlation reportsMeta-analysisKanban tasks
Pipeline
synthesisheal
Schedule
0 */6 * * *
Daemon that monitors agent health. Kills stuck jobs, restarts failed agents, tracks uptime in SQLite database. Heartbeats every 15 minutes.
Sources
Cron jobs.jsonAgent outboxesProcess table
Actions
Health monitoringAuto-restartHeartbeat tracking
Outputs
Health reportsRestart logs
Pipeline
meta
Schedule
*/15 * * * *
Route53 DNS change detection. Monitors AWS Route53 DNS records for unauthorized changes, new subdomains, or removed records daily.
Sources
AWS Route53 APIDNS records
Actions
DNS record monitoringChange detectionAlert generation
Outputs
DNS change reportsAlert notifications
Pipeline
soc-alerts
Schedule
0 0 * * *
Daily CISO threat intelligence brief. Generates a concise daily summary of top threats, incidents, and recommendations for CISO review.
Sources
All agent outboxesMDE alertsAgent feeds
Actions
Threat aggregationPriority sortingExecutive summary generation
Outputs
Daily CISO brief (PDF)Summary report
Schedule
0 0 * * *
Monthly CISO threat intelligence report. Generates comprehensive monthly PDF with statistics, trends, and strategic recommendations.
Sources
All agent outboxesHistorical dataTrend analysis
Actions
Monthly aggregationStatistical analysisPDF generation
Outputs
Monthly CISO report (PDF)Executive summary
Schedule
0 0 1 * *
VOC platform health monitor. Checks VOC service health every 5 minutes, monitors API endpoints and database connectivity.
Sources
VOC APIHealth endpointsDatabase checks
Actions
Health checkUptime monitoringAlert on failure
Outputs
Health statusUptime statistics
Pipeline
soc-alerts
Schedule
every 5m
SIEM database daily maintenance. Prunes old SIEM data daily to manage database size and performance.
Sources
SIEM database
Actions
Data pruningRetention policy enforcementMaintenance
Outputs
Prune logsDatabase stats
Schedule
0 6 * * *
SIEM database weekly maintenance. Performs full vacuum and optimization on SIEM database to maintain performance.
Sources
SIEM database
Actions
VACUUMIndex optimizationPerformance maintenance
Outputs
Maintenance logsDatabase size reports
Schedule
0 6 * * 0
Inbox cleanup agent. Enforces 48-hour TTL on agent inbox files, removing stale feedback to prevent disk buildup.
Sources
Agent inbox directories
Actions
TTL enforcementFile cleanupDisk management
Outputs
Cleanup logsDisk usage reports
Schedule
0 5 * * *
SOC alert dispatcher. Pushes critical security alerts to DingTalk SOC group every 30 minutes for immediate action.
Sources
Agent findingsAlert queue
Actions
Alert dispatchDingTalk integrationPriority routing
Outputs
DingTalk alertsNotification logs
Schedule
*/30 * * * *
Agent performance reviewer. Reviews agent output quality, identifies optimization opportunities, and suggests improvements to agent prompts and configurations.
Sources
All agent outboxesHealer health DBKanban board
Actions
Performance reviewQuality assessmentOptimization suggestions
Outputs
Performance review reportsOptimization recommendations
Pipeline
meta
Schedule
0 3 * * 1