Skip to content

Commit c2582d0

Browse files
claudeclaude
committed
Clean up Phase 4 slide and add GNATHunt capability slide
- Remove (v1.6) version reference from Phase 4 title - Remove migration 0004 reference from ExecutionContext line - Add new dedicated GNATHunt slide covering STIX → detection rules, hunt packages, ATT&CK coverage mapping, and drift detection - Update presentation title from 37-slide to 38-slide https://claude.ai/code/session_01FUJQyGdWpZSgYkW1Xb95gU
1 parent 122eea2 commit c2582d0

1 file changed

Lines changed: 27 additions & 15 deletions

File tree

‎docs/deck/index.html‎

Lines changed: 27 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<head>
44
<meta charset="utf-8">
55
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6-
<title>GNAT — 37-Slide Presentation</title>
6+
<title>GNAT — 38-Slide Presentation</title>
77
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/reveal.css">
88
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/theme/black.css">
99
<style>
@@ -52,18 +52,6 @@ <h2>The Solution</h2>
5252
</ul>
5353
</section>
5454

55-
<section data-background="#1a1a1a">
56-
<h2>The Abstraction Advantage</h2>
57-
<ul style="font-size: 0.8em;">
58-
<li><strong>Portability:</strong> Switch platforms, pipeline stays the same</li>
59-
<li><strong>Maintenance:</strong> API changes affect one connector, not every script</li>
60-
<li><strong>Consistency:</strong> One interface works across 159 platforms</li>
61-
<li><strong>Coherence:</strong> One scheduler, one log stream, one health endpoint</li>
62-
<li><strong>Incremental:</strong> Each layer independently useful</li>
63-
<li><strong>Testing:</strong> 5,100+ unit tests, 70% coverage minimum</li>
64-
</ul>
65-
</section>
66-
6755
<section data-background="#1a1a1a">
6856
<h2>Core Architecture</h2>
6957
<p style="font-size: 0.8em;">
@@ -79,6 +67,18 @@ <h2>Core Architecture</h2>
7967
</p>
8068
</section>
8169

70+
<section data-background="#1a1a1a">
71+
<h2>The Abstraction Advantage</h2>
72+
<ul style="font-size: 0.8em;">
73+
<li><strong>Portability:</strong> Switch platforms, pipeline stays the same</li>
74+
<li><strong>Maintenance:</strong> API changes affect one connector, not every script</li>
75+
<li><strong>Consistency:</strong> One interface works across 159 platforms</li>
76+
<li><strong>Coherence:</strong> One scheduler, one log stream, one health endpoint</li>
77+
<li><strong>Incremental:</strong> Each layer independently useful</li>
78+
<li><strong>Testing:</strong> 5,100+ unit tests, 70% coverage minimum</li>
79+
</ul>
80+
</section>
81+
8282
<!-- DATA & CONNECTORS SECTION (Slides 6-8) -->
8383
<section data-background="#1a1a1a">
8484
<h2>159 Platform Connectors</h2>
@@ -392,10 +392,10 @@ <h2>AI Intel Review Queue</h2>
392392
</section>
393393

394394
<section data-background="#1a1a1a">
395-
<h2>Phase 4 — Control, Reasoning & Safety (v1.6)</h2>
395+
<h2>Phase 4 — Control, Reasoning & Safety</h2>
396396
<p style="font-size: 0.85em;">ExecutionContext, domain boundaries, hypothesis engine, agent governor, HITL</p>
397397
<ul style="font-size: 0.8em; margin-top: 1em;">
398-
<li><strong>ExecutionContext:</strong> Every operation stamped with context_id, domain, trust_level, workspace_id. Append-only execution_log (migration 0004). Full audit trail from connector call to report.</li>
398+
<li><strong>ExecutionContext:</strong> Every operation stamped with context_id, domain, trust_level, workspace_id. Append-only execution_log. Full audit trail from connector call to report.</li>
399399
<li><strong>Domain Boundaries:</strong> Ingestion ↔ Analysis ↔ Investigation ↔ Reporting enforced. @domain_boundary decorator raises DomainBoundaryViolation on illegal cross-domain calls.</li>
400400
<li><strong>HypothesisEngine + NegativeEvidence:</strong> propose → evaluate → close lifecycle. Confidence scoring weighted by connector TRUST_LEVEL (0.9/0.6/0.3). NegativeEvidenceRecord suppresses redundant re-queries within TTL.</li>
401401
<li><strong>Connector Trust Model:</strong> 31 trusted_internal (0.9) · 61 semi_trusted (0.6) · 7 untrusted_external (0.3)</li>
@@ -440,6 +440,18 @@ <h2>Deployment Architecture</h2>
440440
</ul>
441441
</section>
442442

443+
<section data-background="#1a1a1a">
444+
<h2>GNATHunt — Detection Rules & Hunting</h2>
445+
<p style="font-size: 0.85em;">Convert STIX to detection rules. Hunt packages. ATT&CK coverage mapping. Drift detection.</p>
446+
<ul style="font-size: 0.8em; margin-top: 1em;">
447+
<li><strong>STIX → Detection Rules:</strong> Malware/Campaign/Tool indicators → Sigma + YARA + Suricata + Snort rules. Confidence-weighted rule weight. Automated rule publication to EDL + SOC platform integrations.</li>
448+
<li><strong>Hunt Packages:</strong> Bundled rules with metadata (adversary, campaign, techniques, severity). Importable into Splunk, Elastic, Chronicle, QRadar. Version control + diff tracking.</li>
449+
<li><strong>ATT&CK Coverage Mapping:</strong> Every rule tagged with MITRE ATT&CK technique/sub-technique. Coverage heatmap by tactic. Gaps identified and prioritized.</li>
450+
<li><strong>Drift Detection:</strong> Scheduled hunt job compares rule effectiveness (hit count, FP rate) against baseline. Drift >10% triggers analyst review. Rules auto-archived if no hits in 90 days.</li>
451+
<li><strong>Integration:</strong> GNATHunt hooks into campaign tracking — when Campaign confirmed, emit detection rules + hunt package. Daily hunts run via FeedScheduler.</li>
452+
</ul>
453+
</section>
454+
443455
<section data-background="#1a1a1a">
444456
<h2>All Roadmap Items Complete</h2>
445457
<p style="font-size: 0.85em;">✓ Every pending item has shipped — v1.9.0 complete</p>

0 commit comments

Comments
 (0)