A flagged inbound message traverses the suite — Tektaris scores it, Kryptaris gates the cross-product read, Oraculum evaluates the agent rules, Caduceon signs and ships the patch. Caduceon rows highlighted.
Subject "Quick wire request — board approved" from finance@nort hstar-corp.example. 17-signal D.A.E. scored 0.84. Verdict: high_risk.
tektaris.fraud-detector: SIGNAL display_vs_from=DRIFT spf=PASS dkim=PASS domain_age=14d link_target_match=NO body_cadence=OK
WHOIS, ip-api, OpenCorporates, Google News, DuckDuckGo presence — all 8 modules dispatched in parallel.
tektaris.osint: jobs=8 parallel timeout=10s
Tektaris asked Kryptaris for subject.email_history for from_addr. Kryptaris enforced tenant_scope + no_pii_for_analyst. 240 rows returned, 18 columns masked.
kryptaris.query: SELECT … FROM email WHERE tenant_id=? USING (tenant_scope, no_pii_for_analyst) → 240 rows, 18 masked
Token used outside business hours? YES (02:14 UTC). Rows exported > 10k? NO (240). Verdict: PASS (1/3 rules fire).
oraculum.agent.off-hours-export: R01=fire R02=fire R03=pass → VERDICT pass
Token user-agent first seen 12 min ago. Op in privileged set: YES. Geo change: YES. Step-up MFA fresh: NO. Verdict: FIRE.
oraculum.agent.new-device-priv-op: R01=fire R02=fire R03=fire R04=fail → VERDICT fire
Patch v4.12.2 to quarantine sender at the API edge. RS-4096 signature from HSM slot 02. 3/4 quorum reached at p99 0.84ms.
caduceon.signer: target=tektaris-api/v4.12.2 alg=RSASSA-PSS fingerprint=7F:24:9A:E1 quorum=3/4 took=0.83ms
Batch 1/8 of 47 edge nodes received the patch. Healthcheck gating: green. ETA full rollout: 4m20s.
caduceon.deploy: target=tektaris-api environment=edge batch=1/8 health=green eta=4m20s
WHOIS: domain registered 14 days ago. ip-api: country=NL, ASN bulletproof hosting. News: 0 mentions. Verdict consolidated: malicious actor, attempted CEO-impersonation.
tektaris.subject-card: ref=TK-A1B2C3D4 likely_attribution=fraud confidence=0.91
Full event chain logged into audit_trail. 14 entries (1 per product handoff). Schema-level retention: 18 months. Cross-tenant returns: 0.
kryptaris.audit: actor_chain=tektaris→kryptaris→oraculum→caduceon entries=14 retained=540d
Tektaris alert to the flagged sender pointing at a public, time-bounded intelligence report. Tracking ref TK-A1B2C3D4.
tektaris.alert: to=finance@northstar-corp.example ref=TK-A1B2C3D4 url=https://blackgridlabs.com/report/…
47/47 edge nodes confirmed patched. Sender quarantined at all ingress points. Air-gap mirror queued for courier.
caduceon.deploy: target=tektaris-api stage=edge complete=47/47 air-gap=queued