v0idAgentic — Design Document

> Autonomous Defensive Cyber Operations Platform > Version 1.0 | March 2026 | Scott Gardner — ninja.ing > 虚空守護 (Void Guardian)

Executive Summary
System Architecture
Agent Architecture
Playbook Engine
Detection Engineering
Forensic Collection
LLM Reasoning Engine
Data Flow
Neo4j Schema
API Reference
UI Architecture
Deployment Architecture
Configuration Reference
ANTOS — DevSecOps Pipeline

1. Executive Summary

v0idAgentic is an autonomous defensive cyber operations platform that uses LLM-powered reasoning to detect, triage, contain, and hunt threats. Unlike traditional SOAR platforms that rely on hardcoded if/then rules, v0idAgentic delegates every decision — triage severity, containment strategy, hunt hypothesis generation — to Claude, with structured confidence scoring and graduated autonomy controls.

Key Capabilities

Capability	Description
Autonomous Triage	Sentinel agent enriches alerts with threat intel + adversary profiles, reasons about severity
Automated Containment	Warden agent plans and executes isolation, blocking, account disable with full rollback
Proactive Hunting	Spectre agent generates hunt hypotheses from technique gaps, searches event stores
IR Playbooks	8 YAML-driven playbooks with LLM reasoning at every decision point
Detection Engineering	4 agents: coverage mapping, rule tuning, signature generation, correlation building
Forensic Collection	Memory dumps, disk artifacts, PCAP capture with chain-of-custody
Claude AI Chat	Direct administrator interface to Claude with full platform context

Technology Stack

Layer	Technology
Backend	Python 3.11, FastAPI, Neo4j 5
Frontend	Next.js 16, React 19, TypeScript, Tailwind CSS v4
LLM	Anthropic Claude (Sonnet 4.5 default, configurable)
Deployment	Docker Compose, Caddy reverse proxy
Domain	ninjav0id.io (root), ninjav0id.io/void (V01d sentiment)

Philosophy

> Agentic, NOT SOAR. Every decision is reasoned, not scripted. The system "reeks of AI" — LLM reasoning at every junction, confidence scoring on every verdict, graduated autonomy from notify-only to full auto-response.

2. System Architecture

High-Level Overview

graph TB
    subgraph External["External Systems"]
        RAZOR["Raz0r SIEM<br/>ninjaraz0r.ninja"]
        RTM["RTM Threat Graph<br/>ninjasignal.ninja"]
        AZURE["Azure AD<br/>Entra ID"]
        CLAUDE_API["Anthropic API<br/>Claude LLM"]
    end

    subgraph V0ID["v0idAgentic Platform"]
        direction TB
        ORCH["Orchestrator"]

        subgraph CORE["Core Agents"]
            SEN["Sentinel<br/>Triage"]
            WAR["Warden<br/>Containment"]
            SPE["Spectre<br/>Threat Hunting"]
        end

        subgraph DETECT["Detection Engineering"]
            COV["Coverage Mapper"]
            TUN["Rule Tuner"]
            SIG["Signature Generator"]
            COR["Correlation Builder"]
        end

        subgraph FORENSIC["Forensic Collection"]
            MEM["Memory Collector"]
            DSK["Disk Collector"]
            NET["Network Collector"]
            PKG["Evidence Packager"]
        end

        subgraph ENGINE["Playbook Engine"]
            PBE["Playbook Engine<br/>8 YAML Playbooks"]
            PBR["Playbook Runner<br/>Step Executor"]
        end

        NEO["Neo4j 5<br/>Graph Database"]
        UI["Next.js UI<br/>14 Windows"]
    end

    RAZOR -->|WebSocket alerts| ORCH
    ORCH --> SEN
    ORCH --> WAR
    ORCH --> SPE
    SEN -->|enrichment| RTM
    SEN -->|reasoning| CLAUDE_API
    WAR -->|commands| RAZOR
    WAR -->|account ops| AZURE
    WAR -->|reasoning| CLAUDE_API
    SPE -->|event search| RAZOR
    SPE -->|graph search| RTM
    SPE -->|reasoning| CLAUDE_API
    COV -->|techniques| RTM
    COV -->|rules| RAZOR
    SEN --> NEO
    WAR --> NEO
    SPE --> NEO
    PBE --> NEO
    UI --> NEO

Component Inventory

Component	File	Lines	Purpose
Orchestrator	`core/orchestrator.py`	213	Coordinates all 14 subsystems
Sentinel	`core/sentinel.py`	198	Alert triage with LLM reasoning
Warden	`core/warden.py`	236	Containment planning + execution
Spectre	`core/spectre.py`	387	Hypothesis-driven threat hunting
Playbook Engine	`core/playbook_engine.py`	215	YAML playbook loader + trigger matching
Playbook Runner	`core/playbook_runner.py`	299	Phase/step execution engine
Coverage Mapper	`core/coverage_mapper.py`	182	ATT&CK technique coverage analysis
Rule Tuner	`core/rule_tuner.py`	130	FP rate analysis + tuning recommendations
Signature Generator	`core/signature_generator.py`	161	Auto-generate detection signatures
Correlation Builder	`core/correlation_builder.py`	134	Multi-event correlation rules
Memory Collector	`core/memory_collector.py`	96	Memory dump via Raz0r agent
Disk Collector	`core/disk_collector.py`	111	Prefetch/amcache/MFT/registry collection
Network Collector	`core/network_collector.py`	106	PCAP capture via Raz0r agent
Evidence Packager	`core/evidence_packager.py`	153	Bundle artifacts + chain-of-custody
Reasoning Engine	`core/reasoning.py`	145	LLM reasoning with structured output
Context Builder	`core/context.py`	169	Threat intel enrichment pipeline
Action Engine	`core/actions.py`	303	Execute + rollback response actions
API Application	`v0id_app.py`	757	38 REST endpoints + 1 WebSocket

Total backend: ~4,648 lines of Python across 23 modules.

3. Agent Architecture

Sentinel — Autonomous Triage

flowchart LR
    A[Alert from Raz0r] --> Q[Alert Queue<br/>capacity: 1000]
    Q --> E[Enrich]
    E -->|indicators, actors| RTM[RTM Graph]
    E -->|behavioral profile| TWINS[Twins Module]
    E --> CTX[Build Context]
    CTX --> LLM[Claude Reasoning]
    LLM --> D{Decision}
    D -->|severity=critical<br/>OR confidence>=0.7<br/>OR LLM recommends| ESC[Escalate to Warden]
    D -->|low confidence| LOG[Log Decision]
    ESC --> NEO[(Neo4j)]
    LOG --> NEO

Triage Pipeline:

Ingest — Alert arrives via Raz0r WebSocket or manual API injection
Enrich — Query RTM for indicators -> threat actors -> techniques -> campaigns
Twins Profile — If actor identified, fetch adversarial behavioral model
Build Context — Combine alert + local graph context (prior decisions, open incidents) + RTM enrichment + Twins profile
Reason — LLM analyzes full context, returns structured verdict with confidence 0.0-1.0
Decide — Auto-escalate if: severity=critical OR confidence >= 0.7 OR LLM explicitly recommends

Decision Node Properties:

decision_id, timestamp, alert_type, source_ip, hostname,
decision, confidence, severity, rationale, kill_chain_phase,
escalated, warden_notified

Warden — Autonomous Containment

flowchart TB
    D[Escalated Decision] --> Q[Escalation Queue<br/>capacity: 500]
    Q --> PLAN[LLM Plans Containment]
    PLAN --> ACTIONS

    subgraph ACTIONS["Action Execution (max 5 concurrent)"]
        ISO[isolate_host] --> RAZOR1[Raz0r Agent]
        BLK[block_ip] --> RAZOR2[Raz0r Agent]
        DIS[disable_account] --> AZURE[Azure AD]
        KIL[kill_process] --> RAZOR3[Raz0r Agent]
        QUA[quarantine_file] --> RAZOR4[Raz0r Agent]
    end

    ACTIONS --> CHECK{Autonomy<br/>Level Check}
    CHECK -->|allowed| EXEC[Execute]
    CHECK -->|blocked| BLOCK[Log as blocked_autonomy]
    EXEC --> INC[Create Incident]
    EXEC --> ROLL[Create Rollback Entry]
    INC --> NEO[(Neo4j)]
    ROLL --> NEO

Autonomy Levels:

Level	Actions Allowed	Use Case
0	None (notify only)	Monitoring / evaluation mode
1	`block_ip`, `quarantine_file`	Low-risk automated response
2	Level 1 + `kill_process`, `disable_account`	Medium automation
3	Level 2 + `isolate_host`, `collect_forensics`, `safe_mode`	Full autonomous response

Rollback Support:

Action	Rollback	Reversible
`isolate_host`	`restore_host`	Yes
`block_ip`	`unblock_ip`	Yes
`kill_process`	—	No
`disable_account`	`enable_account`	Yes
`quarantine_file`	`restore_file`	Yes

Rollback window: configurable (default 3600s). Admin can rollback single action or all actions per incident.

Spectre — Autonomous Threat Hunter

flowchart TB
    CYCLE[Hunt Cycle<br/>every 300s] --> GEN[Generate Hypotheses]

    GEN --> SRC1[Technique Gap Analysis]
    GEN --> SRC2[Graph Anomaly Detection]

    SRC1 -->|predicted techniques<br/>minus detection rules| GAPS[Uncovered Techniques]
    SRC2 -->|highly connected indicators<br/>unusual patterns| ANOMALIES[Graph Anomalies]

    GAPS --> LLM1[LLM: Generate Hunts]
    ANOMALIES --> LLM2[LLM: Generate Hunts]

    LLM1 --> HYPO[Hunt Hypotheses<br/>max 10 per cycle]
    LLM2 --> HYPO

    HYPO --> EXEC[Execute Hunts]
    EXEC --> SEARCH1[Search Raz0r Events]
    EXEC --> SEARCH2[Search RTM Graph]

    SEARCH1 --> ANALYZE[LLM Analyzes Results]
    SEARCH2 --> ANALYZE

    ANALYZE --> FIND{Findings?}
    FIND -->|confidence >= 0.6| RULE[Auto-Create Detection Rule]
    FIND -->|no evidence| CLEAN[Mark Clean]
    RULE --> NEO[(Neo4j)]

Hunt Sources:

Technique Gap Analysis — RTM Twins predicts techniques an adversary is likely to use. Raz0r detection rules cover some. The gap = hunt targets.
Graph Anomaly Detection — Query RTM for indicators with >10 relationships (unusually connected IOCs), which may indicate undiscovered campaigns.

4. Playbook Engine

Architecture

flowchart LR
    YAML[8 YAML Playbooks] --> LOAD[PlaybookEngine<br/>Load + Parse]
    ALERT[Alert] --> MATCH{Trigger<br/>Match?}
    MATCH -->|event_type, severity,<br/>keywords, technique_ids| TRIGGER[Trigger Execution]
    TRIGGER --> RUNNER[PlaybookRunner]

    RUNNER --> P1[Phase 1]
    P1 --> P2[Phase 2]
    P2 --> P3[Phase N]

    subgraph STEPS["Step Types"]
        direction TB
        R[reason<br/>LLM decision] --> A[action<br/>Raz0r/Azure command]
        A --> M[manual<br/>approval required]
        M --> W[wait<br/>timed pause]
    end

    P1 --> STEPS
    STEPS --> NEO[(Neo4j<br/>PlaybookExecution<br/>PlaybookStep<br/>ManualApprovalTask)]

Available Playbooks

Playbook	Phases	Steps	Auto-Trigger
ransomware	5	13	`ransom.*` events, keywords: ransomware, encryption
credential_compromise	4	10	T1078, T1110, keywords: credential compromise
bec	4	9	keywords: business email compromise, mail rule
data_exfil	4	10	T1567, T1041, keywords: exfiltration, data leak
insider_threat	4	10	keywords: insider, unauthorized access
ddos	4	8	keywords: DDoS, flood, volumetric
supply_chain	4	10	T1195, keywords: supply chain, dependency
zero_day	4	10	keywords: zero day, 0day, unpatched

Step Execution Model

Reason Steps — LLM analyzes context against a prompt (e.g., "Is this ransomware or a false positive?"). Returns decision + confidence. If confidence < threshold, step marks low_confidence and on_fail strategy applies.

Action Steps — Execute via Raz0r agent or Azure AD. Reads target from context (populated by prior reason steps). Supports force=true to bypass autonomy gating.

Manual Steps — Create ManualApprovalTask node and block execution until analyst approves via API or timeout expires (default 3600s).

Wait Steps — asyncio.sleep(n) for timed pauses between phases.

Ransomware Playbook Example

Phase 1: Detection & Validation
  |- [reason] Analyze alert — is this real ransomware or FP?
  |- [reason] Identify kill chain phase and scope

Phase 2: Containment
  |- [action] isolate_host (affected endpoints)
  |- [action] block_ip (C2 addresses)
  |- [action] disable_account (compromised accounts)

Phase 3: Evidence Preservation
  |- [action] collect_forensics — memory dump
  |- [action] collect_forensics — disk artifacts
  |- [action] collect_forensics — network capture

Phase 4: Eradication
  |- [manual] Analyst approval required before eradication
  |- [action] kill_process (ransomware processes)
  |- [reason] Verify eradication completeness

Phase 5: Recovery
  |- [wait] 300s monitoring period
  |- [reason] Assess recovery readiness

5. Detection Engineering

Four Autonomous Agents

flowchart LR
    subgraph COVERAGE["Coverage Mapper (every 1h)"]
        T[RTM Techniques] --> MAP[Compare]
        R[Raz0r Rules] --> MAP
        MAP --> GAPS[Gap Report]
    end

    subgraph TUNER["Rule Tuner (every 30m)"]
        AL[Alert Volumes<br/>last 24h] --> FP[FP Heuristic]
        FP --> LLM1[LLM: Tune?]
        LLM1 --> TUNE[Tuning Actions]
    end

    subgraph SIGGEN["Signature Generator (every 1h)"]
        INC[Resolved Incidents<br/>without signatures] --> PAT[Extract Patterns]
        PAT --> LLM2[LLM: Generate Rule]
        LLM2 --> SIG[New Detection Rules]
    end

    subgraph CORR["Correlation Builder (every 2h)"]
        MULTI[Incidents with<br/>>=2 Decisions] --> SEQ[Extract Sequence]
        SEQ --> LLM3[LLM: Correlation Rule]
        LLM3 --> CRULE[Correlation Rules]
    end

    GAPS --> NEO[(Neo4j)]
    TUNE --> NEO
    SIG --> NEO
    CRULE --> NEO

Agent	Interval	Input	Output
CoverageMapper	3600s	RTM techniques + Raz0r rules	`CoverageReport` + `DetectionCoverage` nodes
RuleTuner	1800s	24h alert volumes (>20/day)	`TuningAction` recommendations
SignatureGenerator	3600s	Resolved incidents without signatures	`DetectionRule` nodes (status: `pending_review`)
CorrelationBuilder	7200s	Multi-step incidents (>=2 decisions)	`CorrelationRule` nodes

6. Forensic Collection

Collection Pipeline

flowchart LR
    TRIGGER[Warden Containment<br/>OR Manual API] --> COLLECT

    subgraph COLLECT["Artifact Collection"]
        MEM["Memory Dump<br/>via Raz0r"]
        DISK["Disk Artifacts<br/>prefetch, amcache,<br/>shimcache, MFT,<br/>event logs, registry"]
        NET["Network Capture<br/>PCAP via Raz0r<br/>default 300s"]
    end

    COLLECT --> COC[Chain-of-Custody<br/>JSON audit trail]
    COC --> EVIDENCE["ForensicEvidence<br/>Nodes in Neo4j"]
    EVIDENCE --> PKG[Evidence Packager]
    PKG --> BUNDLE["ForensicPackage<br/>SHA256 manifest hash"]

    BUNDLE -.->|linked to| INC[Incident]

Chain-of-Custody — Every evidence artifact maintains a JSON array tracking all actions: collection, handling, packaging. Each entry records action, by (agent/analyst), at (timestamp), and package_id if bundled.

Evidence Package — Bundles all evidence for an incident. Computes SHA256 hash of the JSON manifest (sorted keys) for integrity verification.

7. LLM Reasoning Engine

Design

The reasoning engine (core/reasoning.py) is the decision-making core of v0idAgentic. Every agent decision flows through it.

sequenceDiagram
    participant Agent as Agent (Sentinel/Warden/Spectre)
    participant Reason as Reasoning Engine
    participant Claude as Claude API

    Agent->>Reason: reason(agent_name, context, question)
    Reason->>Reason: Build system prompt (V0id persona)
    Reason->>Reason: Build user message (context + question)
    Reason->>Claude: POST /messages (HS256, temp=0.3)
    Claude-->>Reason: JSON response
    Reason->>Reason: Parse structured output
    Reason-->>Agent: ReasoningResult

System Prompt (V0id Persona)

> "You are V0id, an autonomous defensive cyber agent. You analyze threat intelligence context and make decisions about incident response. You are NOT a rule engine — you REASON about threats using context, adversary behavior, kill chain position, and organizational risk."

Structured Output Schema

{
  "decision": "Brief decision statement",
  "confidence": 0.85,
  "rationale": "Detailed reasoning chain",
  "actions": [
    {"type": "isolate_host", "target": "WS-042", "params": {}}
  ],
  "severity": "critical",
  "escalate": true
}

Confidence Calibration

Range	Interpretation	Agent Behavior
0.9-1.0	Clear threat, act immediately	Auto-execute all recommended actions
0.7-0.9	Likely threat, recommend action	Auto-execute + monitor
0.5-0.7	Uncertain, gather more context	Log decision, continue monitoring
< 0.5	Insufficient evidence	Observe only, no action

Model Configuration

Parameter	Default	Description
`reasoning_model`	`claude-sonnet-4-5-20250929`	Anthropic model ID
`reasoning_max_tokens`	2048	Max output tokens per reasoning call
`reasoning_temperature`	0.3	Low temperature for deterministic IR decisions

8. Data Flow

End-to-End Alert Processing

sequenceDiagram
    participant SIEM as Raz0r SIEM
    participant WS as WebSocket
    participant ORCH as Orchestrator
    participant SEN as Sentinel
    participant RTM as RTM Graph
    participant LLM as Claude
    participant WAR as Warden
    participant NEO as Neo4j
    participant UI as UI

    SIEM->>WS: Alert stream
    WS->>ORCH: Alert JSON
    ORCH->>SEN: ingest_alert()

    Note over SEN: Enrichment Phase
    SEN->>RTM: enrich_alert(source_ip)
    RTM-->>SEN: actors, techniques, campaigns
    SEN->>RTM: get_twins_profile(actor)
    RTM-->>SEN: behavioral model

    Note over SEN: Reasoning Phase
    SEN->>LLM: reason("sentinel", context, question)
    LLM-->>SEN: {decision, confidence, severity, escalate}
    SEN->>NEO: CREATE (d:Decision {...})

    alt escalated = true
        ORCH->>WAR: escalate(decision)
        Note over WAR: Containment Planning
        WAR->>LLM: reason("warden", context, "plan containment")
        LLM-->>WAR: {actions: [isolate, block, disable]}

        Note over WAR: Action Execution
        WAR->>SIEM: isolate_host(hostname)
        WAR->>SIEM: block_ip(c2_addr)
        WAR->>NEO: CREATE (a:ResponseAction {...})
        WAR->>NEO: CREATE (i:Incident {...})
    end

    Note over ORCH: Playbook Check
    ORCH->>ORCH: match_trigger(alert)
    alt playbook matched
        ORCH->>ORCH: trigger(playbook_id, alert)
    end

    UI->>NEO: Poll dashboard data
    NEO-->>UI: Decisions, incidents, actions

Connector Integration Map

graph LR
    subgraph V0ID["v0idAgentic"]
        RC[RazorClient<br/>connectors/razor_client.py]
        TC[RTMClient<br/>connectors/rtm_client.py]
        AC[AzureClient<br/>connectors/azure_client.py]
    end

    subgraph RAZOR["Raz0r SIEM"]
        WS_A[/ws/alerts<br/>WebSocket/]
        CMD[/agents/{id}/command<br/>POST/]
        EVT[/events/search<br/>GET/]
        RUL[/rules/generated<br/>GET/]
    end

    subgraph RTM_SYS["RTM Threat Graph"]
        ENR[/search<br/>POST/]
        TECH[/techniques<br/>GET/]
        TWINS_E[/twins/profile/{name}<br/>GET/]
        PREDICT[/twins/predict/{name}<br/>GET/]
    end

    subgraph AZ["Azure AD / Entra ID"]
        USR[/users/{upn}<br/>PATCH/]
        REV[/users/{upn}/revokeSignInSessions<br/>POST/]
        LOGS[/auditLogs/signIns<br/>GET/]
    end

    RC -->|WebSocket| WS_A
    RC -->|HTTP POST| CMD
    RC -->|HTTP GET| EVT
    RC -->|HTTP GET| RUL

    TC -->|HTTP POST| ENR
    TC -->|HTTP GET| TECH
    TC -->|HTTP GET| TWINS_E
    TC -->|HTTP GET| PREDICT

    AC -->|OAuth2 + HTTP PATCH| USR
    AC -->|OAuth2 + HTTP POST| REV
    AC -->|OAuth2 + HTTP GET| LOGS

9. Neo4j Schema

Node Labels (17)

graph TB
    subgraph CORE["Core Operations"]
        D[Decision]
        RA[ResponseAction]
        INC[Incident]
        HH[HuntHypothesis]
        TC[ThreatContext]
        AL[ActionLog]
        RB[Rollback]
    end

    subgraph PLAYBOOK["Playbook Execution"]
        PE[PlaybookExecution]
        PS[PlaybookStep]
        MAT[ManualApprovalTask]
    end

    subgraph DETECTION["Detection Engineering"]
        DC[DetectionCoverage]
        CR_NODE[CoverageReport]
        TA[TuningAction]
        CORR[CorrelationRule]
        DR[DetectionRule]
    end

    subgraph FORENSICS["Forensic Collection"]
        FE[ForensicEvidence]
        FP[ForensicPackage]
    end

    D -->|TRIGGERED| RA
    D -->|ESCALATED_TO| INC
    INC -->|CONTAINS| RA
    INC -->|HAS_EVIDENCE| FE
    INC -->|HAS_PACKAGE| FP
    INC -->|HAS_SIGNATURE| DR
    FP -->|CONTAINS| FE
    PE -->|HAS_STEP| PS
    HH -->|GENERATED| DR
    RA -->|HAS_ROLLBACK| RB

Constraints (17 uniqueness)

Label	Unique Property
Decision	`decision_id`
ResponseAction	`action_id`
Incident	`incident_id`
HuntHypothesis	`hypothesis_id`
ThreatContext	`context_id`
ActionLog	`log_id`
Rollback	`rollback_id`
PlaybookExecution	`execution_id`
PlaybookStep	`step_record_id`
ManualApprovalTask	`task_id`
DetectionCoverage	`technique_id`
CoverageReport	`report_id`
TuningAction	`tuning_id`
CorrelationRule	`rule_id`
DetectionRule	`rule_id`
ForensicEvidence	`evidence_id`
ForensicPackage	`package_id`

Indexes (28)

All timestamp fields, status fields, severity, confidence, and artifact_type are indexed for query performance.

10. API Reference

Authentication

Cookie: ninja-v0id-token (HttpOnly, SameSite=lax, 7-day expiry)
JWT: HS256, secret from JWT_SECRET env var
Roles: admin (full access), viewer (read-only)

Endpoints (38 REST + 1 WebSocket)

Health & Status

Method	Path	Auth	Description
GET	`/health`	None	Platform health + version
GET	`/dashboard`	User	Aggregated metrics, open incidents
WS	`/ws/agents`	None	Real-time agent status (5s interval)

Agent Control

Method	Path	Auth	Description
GET	`/agents/status`	User	All agent stats
GET	`/agents/sentinel`	User	Sentinel stats
GET	`/agents/warden`	User	Warden stats
GET	`/agents/spectre`	User	Spectre stats
POST	`/agents/autonomy`	Admin	Set autonomy level (0-3)

Alert Ingestion

Method	Path	Auth	Description
POST	`/alerts/ingest`	User	Manually inject alert

Decisions & Actions

Method	Path	Auth	Description
GET	`/decisions`	User	List recent decisions
GET	`/decisions/{id}`	User	Decision detail + context
GET	`/actions`	User	List response actions
POST	`/actions/{id}/rollback`	Admin	Rollback single action
POST	`/actions/rollback-all`	Admin	Rollback all (optional incident filter)
GET	`/action-log`	User	Audit log entries

Incidents

Method	Path	Auth	Description
GET	`/incidents`	User	List incidents (status filter)
GET	`/incidents/{id}`	User	Incident detail
PATCH	`/incidents/{id}`	User	Update status/notes

Hunts

Method	Path	Auth	Description
GET	`/hunts`	User	List hunt hypotheses
POST	`/hunts/manual`	User	Trigger manual hunt

Playbooks

Method	Path	Auth	Description
GET	`/playbooks`	User	List available playbooks
POST	`/playbooks/{id}/trigger`	User	Trigger playbook
GET	`/playbooks/executions`	User	List executions
GET	`/playbooks/executions/{id}`	User	Execution detail
POST	`/playbooks/executions/{id}/approve/{step_id}`	User	Approve manual step

Detection Engineering

Method	Path	Auth	Description
GET	`/detection/coverage`	User	ATT&CK coverage summary
GET	`/detection/coverage/gaps`	User	Uncovered techniques
POST	`/detection/coverage/run`	Admin	Manual mapping run
GET	`/detection/tuning/history`	User	Rule tuning history
POST	`/detection/signature/generate`	User	Generate signature from context
GET	`/detection/correlations`	User	Correlation rules

Forensics

Method	Path	Auth	Description
POST	`/forensics/collect`	User	Trigger collection (memory/disk/network)
GET	`/forensics/evidence`	User	List evidence artifacts
POST	`/forensics/package/{incident_id}`	User	Create evidence package
GET	`/forensics/packages`	User	List packages
GET	`/forensics/chain-of-custody/{id}`	User	Chain-of-custody for evidence

Claude AI

Method	Path	Auth	Description
POST	`/claude/chat`	User	Chat with Claude (requires `ANTHROPIC_API_KEY`)

Graph & Admin

Method	Path	Auth	Description
GET	`/graph/stats`	User	Node counts by label
POST	`/cypher`	Admin	Execute Cypher query
POST	`/login`	None	Login
POST	`/register`	None	Register
GET	`/users`	Admin	List users

11. UI Architecture

Window System

v0idAgentic uses a floating window desktop interface with 14 independent windows, each displaying a different operational view.

graph TB
    subgraph DESKTOP["Desktop Environment"]
        direction LR
        SIDEBAR["Sidebar<br/>14 window launchers"]
        TASKBAR["Taskbar<br/>open window tabs"]
    end

    subgraph WINDOWS["Floating Windows (14)"]
        CC["Command Center<br/>Dashboard + metrics"]
        SEN_W["Sentinel<br/>Triage stats + decisions"]
        WAR_W["Warden<br/>Actions + rollback"]
        SPE_W["Spectre<br/>Hunts + manual trigger"]
        INC_W["Incidents<br/>Board + status mgmt"]
        DEC_W["Decisions<br/>Decision log + detail"]
        CTX_W["Context Map<br/>Enrichment visualization"]
        PB_W["Playbooks<br/>Library + execution + approval"]
        COV_W["Coverage<br/>ATT&CK matrix + gaps"]
        FOR_W["Forensics<br/>Collection + chain-of-custody"]
        RT_W["Rule Tuner<br/>Tuning history"]
        COR_W["Correlations<br/>Correlation rules"]
        CL_W["Claude AI<br/>Chat interface"]
        ADM_W["Admin<br/>Users + Cypher + config"]
    end

    SIDEBAR --> WINDOWS
    TASKBAR --> WINDOWS

Theme

B-2 Stealth Monochrome — matching the Ninja Signal design language.

Element	Value
Background	`#030303`
Card	`#0a0a0a`
Border	`#151515`
Text	`#c8c8c8`
Muted	`#5a6a7a`
Accent (teal)	`#4a8a8a`
AI accent	`#7a9aba`

AI Branding — "AI-POWERED" badges, neural-gradient animations, "POWERED BY CLAUDE" tags, thinking dot animations.

Window Persistence

Window state (position, size, minimized, maximized, z-index) persists to localStorage under the key v0id-windows. State survives page refreshes.

12. Deployment Architecture

Production Topology

graph TB
    subgraph CF["Cloudflare"]
        DNS["ninjav0id.io<br/>DNS + CDN"]
    end

    subgraph SERVER["Hetzner VPS (135.181.19.232)"]
        subgraph RTM_NET["rapid-threat-modeler_default network"]
            CADDY["Caddy<br/>TLS termination<br/>reverse proxy"]
            RTM_API["RTM API<br/>:18011"]
            RTM_NEO["Neo4j 5<br/>:7687<br/>(shared)"]
            SIEM["Raz0r SIEM<br/>:18013"]

            subgraph V0ID_SVC["v0idAgentic Containers"]
                V0_API["v0id-api<br/>:18019"]
                V0_UI["v0id-ui<br/>:3000"]
            end

            subgraph V01D_SVC["V01d Containers"]
                V1_API["v01d-api<br/>:18018"]
                V1_UI["v01d-ui<br/>:3000"]
            end
        end
    end

    DNS -->|HTTPS| CADDY
    CADDY -->|"/ -> v0idAgentic"| V0_UI
    CADDY -->|"/api/* -> strip prefix"| V0_API
    CADDY -->|"/void/* -> V01d"| V1_UI
    CADDY -->|"/void/api/* -> strip prefix"| V1_API
    V0_API --> RTM_NEO
    V0_API -->|enrichment| RTM_API
    V0_API -->|commands| SIEM
    V1_API --> RTM_NEO

Caddy Routing (ninjav0id.io)

ninjav0id.io {
    tls /etc/caddy/v0id-certs/origin.pem /etc/caddy/v0id-certs/origin.key

    # V01d sentiment at /void sub-path
    handle /void/api/auth/*    -> ninjav01d-ui-1:3000
    handle_path /void/api/*    -> ninjav01d-api-1:18018 (prefix stripped)
    handle /void/*             -> ninjav01d-ui-1:3000

    # v0idAgentic at root
    handle /api/auth/*         -> ninjav0id-ui-1:3000
    handle /api/admin/users*   -> ninjav0id-ui-1:3000
    handle_path /api/*         -> ninjav0id-api-1:18019 (prefix stripped)
    handle                     -> ninjav0id-ui-1:3000
}

Docker Compose (Production)

Base (docker-compose.yml): Neo4j + API with dev ports.

Override (docker-compose.server.yml): - Disables Neo4j (uses RTM's shared instance) - Removes port exposure (Caddy-only access) - Adds UI container - Joins rapid-threat-modeler_default network - Sets production env vars

Deployment Commands

# SCP files (no git on server)
scp -r core/ connectors/ playbooks/ v0id_app.py requirements.txt \
  Dockerfile docker-compose*.yml [email protected]:/opt/ninjav0id/
scp -r ui-app/src/ ui-app/package.json ui-app/Dockerfile \
  [email protected]:/opt/ninjav0id/ui-app/

# Build + deploy
ssh [email protected] "cd /opt/ninjav0id && \
  docker compose -f docker-compose.yml -f docker-compose.server.yml \
  build --no-cache api ui && \
  docker compose -f docker-compose.yml -f docker-compose.server.yml up -d"

# Restart Caddy (for routing changes)
ssh [email protected] "cd /opt/rapid-threat-modeler && \
  docker compose -f docker-compose.yml -f docker-compose.prod.yml \
  restart caddy"

13. Configuration Reference

All settings are configurable via V0ID_* environment variables (Pydantic Settings).

Autonomy & Agents

Variable	Default	Description
`V0ID_AUTONOMY_LEVEL`	`1`	0=notify, 1=low-auto, 2=medium, 3=full
`V0ID_SENTINEL_POLL_INTERVAL`	`5.0`	Alert queue poll timeout (seconds)
`V0ID_SENTINEL_CONFIDENCE_THRESHOLD`	`0.7`	Auto-escalate if confidence >=
`V0ID_SENTINEL_AUTO_ESCALATE_SEVERITY`	`critical`	Auto-escalate if severity ==
`V0ID_WARDEN_ROLLBACK_WINDOW`	`3600`	Rollback window (seconds)
`V0ID_WARDEN_MAX_CONCURRENT_ACTIONS`	`5`	Max actions per containment
`V0ID_SPECTRE_HUNT_INTERVAL`	`300`	Hunt cycle interval (seconds)
`V0ID_SPECTRE_MAX_HYPOTHESES`	`10`	Max hypotheses per cycle

LLM Reasoning

Variable	Default	Description
`ANTHROPIC_API_KEY`	—	Required for LLM reasoning
`V0ID_REASONING_MODEL`	`claude-sonnet-4-5-20250929`	Model ID
`V0ID_REASONING_MAX_TOKENS`	`2048`	Max output tokens
`V0ID_REASONING_TEMPERATURE`	`0.3`	Sampling temperature

Connectors

Variable	Default	Description
`V0ID_RAZOR_API_URL`	`http://localhost:18013`	Raz0r SIEM endpoint
`V0ID_RTM_API_URL`	`http://localhost:18011`	RTM threat graph endpoint
`V0ID_AZURE_TENANT_ID`	—	Azure AD tenant ID
`V0ID_AZURE_CLIENT_ID`	—	Azure AD app ID
`V0ID_AZURE_CLIENT_SECRET`	—	Azure AD app secret

Detection Engineering

Variable	Default	Description
`V0ID_COVERAGE_MAPPER_INTERVAL`	`3600`	Coverage mapping cycle (seconds)
`V0ID_RULE_TUNER_INTERVAL`	`1800`	Rule tuning cycle (seconds)
`V0ID_RULE_TUNER_FP_THRESHOLD`	`0.3`	FP rate threshold
`V0ID_SIGNATURE_GENERATOR_INTERVAL`	`3600`	Signature gen cycle (seconds)
`V0ID_CORRELATION_BUILDER_INTERVAL`	`7200`	Correlation analysis cycle (seconds)

Playbooks & Incidents

Variable	Default	Description
`V0ID_PLAYBOOK_AUTO_TRIGGER`	`true`	Enable auto-triggering
`V0ID_PLAYBOOK_TIMEOUT_SECONDS`	`3600`	Max wait for manual approval
`V0ID_INCIDENT_AUTO_CREATE`	`true`	Auto-create incidents from escalations
`V0ID_INCIDENT_MERGE_WINDOW`	`300`	Merge related alerts (seconds)

Forensics

Variable	Default	Description
`V0ID_FORENSIC_AUTO_COLLECT`	`false`	Auto-collect on escalation
`V0ID_NETWORK_CAPTURE_DURATION`	`300`	Default PCAP duration (seconds)
`V0ID_FORENSIC_RETENTION_DAYS`	`90`	Evidence retention period

Infrastructure

Variable	Default	Description
`NEO4J_URI`	`bolt://localhost:17694`	Neo4j connection
`NEO4J_USER`	`neo4j`	Neo4j username
`NEO4J_PASSWORD`	`S0f1a1707-V0ID`	Neo4j password
`JWT_SECRET`	`v0id-change-me-in-production`	JWT signing secret

14. ANTOS — DevSecOps Pipeline

Overview

ANTOS (AI Network Threat Orchestration System) is a DevSecOps pipeline showcase deployed at ninjasignal.ninja/antos. It demonstrates how Claude AI orchestrates 16 security tools across 8 SDLC stages, from threat modeling through continuous monitoring.

Architecture

graph TB
    subgraph PIPELINE["8-Stage DevSecOps Pipeline"]
        direction LR
        P1["1. Plan<br/>Threat Modeling<br/>STRIDE"]
        P2["2. Code<br/>SAST<br/>Semgrep, Gitleaks"]
        P3["3. Build<br/>SCA<br/>npm audit, Trivy"]
        P4["4. Test<br/>DAST<br/>OWASP ZAP, Nuclei"]
        P5["5. Release<br/>Container Scan<br/>Trivy, Syft, Cosign"]
        P6["6. Deploy<br/>IaC Scan<br/>Checkov, OPA"]
        P7["7. Operate<br/>Runtime<br/>Falco, Sentinel"]
        P8["8. Monitor<br/>Compliance<br/>Defender, SecurityHub"]
    end

    CLAUDE["Claude AI<br/>Orchestrator Hub"]

    P1 --> CLAUDE
    P2 --> CLAUDE
    P3 --> CLAUDE
    P4 --> CLAUDE
    P5 --> CLAUDE
    P6 --> CLAUDE
    P7 --> CLAUDE
    P8 --> CLAUDE

    CLAUDE --> TRIAGE["Triage<br/>True/false positive"]
    CLAUDE --> CORRELATE["Correlate<br/>Cross-stage linking"]
    CLAUDE --> FIX["Fix<br/>Generate remediation"]
    CLAUDE --> REPORT["Report<br/>Executive summaries"]

Key Features

Live Findings Dashboard — Accepts real SARIF files from CI/CD pipelines. Findings are displayed with severity filtering, stage filtering, and AI-powered actions (triage, correlate, fix, report).

Real GitHub Actions Pipeline — 6-job workflow runs Semgrep, Gitleaks, Trivy, Syft, Checkov, and OPA on every push. Pipeline fails on CRITICAL or HIGH findings.

Interactive Demonstrations — Step-by-step pipeline walkthrough, org-wide dashboard simulation (6 microservices progressing through 8 stages), radial orchestrator diagram.

16 Security Tools Documented — Each tool catalogued with description, license, integration pattern, and Claude's orchestration role.

Deployment

# Server: /opt/antos
docker compose -f docker-compose.yml -f docker-compose.server.yml build --no-cache ui
docker compose -f docker-compose.yml -f docker-compose.server.yml up -d ui
# Restart RTM Caddy to apply routing

Domain: antos.ninja.ing -> redirects to ninjasignal.ninja/antos
basePath: /antos in next.config.ts
Network: Joins rapid-threat-modeler_default
Memory: 256MB container limit

File Tree

C:\ninjav0id\
|- core/
|   |- __init__.py
|   |- actions.py                 # Action execution + rollback
|   |- context.py                 # Threat context enrichment
|   |- correlation_builder.py     # Multi-event correlation
|   |- coverage_mapper.py         # ATT&CK coverage mapping
|   |- disk_collector.py          # Disk forensic artifacts
|   |- evidence_packager.py       # Evidence bundling + CoC
|   |- graph.py                   # Neo4j adapter
|   |- memory_collector.py        # Memory dump collection
|   |- network_collector.py       # PCAP capture
|   |- orchestrator.py            # Agent coordination
|   |- playbook_engine.py         # YAML playbook loader
|   |- playbook_runner.py         # Step execution engine
|   |- reasoning.py               # LLM reasoning core
|   |- rule_tuner.py              # FP rate analysis
|   |- schema.py                  # Neo4j schema enforcement
|   |- sentinel.py                # Triage agent
|   |- settings.py                # Pydantic Settings
|   |- signature_generator.py     # Detection rule generation
|   |- spectre.py                 # Threat hunting agent
|   |- warden.py                  # Containment agent
|- connectors/
|   |- __init__.py
|   |- azure_client.py            # Azure AD / Entra ID
|   |- razor_client.py            # Raz0r SIEM
|   |- rtm_client.py              # RTM threat graph
|- playbooks/
|   |- __init__.py
|   |- schema.py                  # Pydantic models
|   |- ransomware.yaml
|   |- credential_compromise.yaml
|   |- bec.yaml
|   |- data_exfil.yaml
|   |- insider_threat.yaml
|   |- ddos.yaml
|   |- supply_chain.yaml
|   |- zero_day.yaml
|- ui-app/
|   |- src/
|   |   |- app/                   # Pages + API routes
|   |   |- components/
|   |   |   |- windows/           # 14 floating window components
|   |   |   |- AppShell.tsx
|   |   |   |- AuthProvider.tsx
|   |   |   |- DesktopArea.tsx
|   |   |   |- FloatingWindow.tsx
|   |   |   |- Sidebar.tsx
|   |   |   |- WindowTaskbar.tsx
|   |   |- lib/                   # JWT, auth, dedup fetch
|   |- Dockerfile
|   |- package.json
|- data/                          # User store (users.json)
|- v0id_app.py                    # FastAPI application (757 lines)
|- docker-compose.yml             # Development
|- docker-compose.server.yml      # Production override
|- Dockerfile                     # API container
|- docs/
    |- DESIGN.md                  # This document

Summary Statistics

Metric	Value
Backend Python	4,648 lines across 23 modules
YAML Playbooks	8 IR scenarios
UI Windows	14 floating panels
REST Endpoints	38 + 1 WebSocket
Neo4j Labels	17
Neo4j Constraints	17
Neo4j Indexes	28
Core Agents	3 (Sentinel, Warden, Spectre)
Detection Agents	4 (Coverage, Tuning, Signatures, Correlations)
Forensic Collectors	4 (Memory, Disk, Network, Packager)
Total Subsystems	14 (coordinated by Orchestrator)
Configurable Settings	40+ via `V0ID_*` env vars
External Integrations	Raz0r SIEM, RTM Graph, Azure AD, Anthropic Claude

v0idAgentic — Design Document

Table of Contents

1. Executive Summary

Key Capabilities

Technology Stack

Philosophy

2. System Architecture

High-Level Overview

Component Inventory

3. Agent Architecture

Sentinel — Autonomous Triage

Warden — Autonomous Containment

Spectre — Autonomous Threat Hunter

4. Playbook Engine

Architecture

Available Playbooks

Step Execution Model

Ransomware Playbook Example

5. Detection Engineering

Four Autonomous Agents

6. Forensic Collection

Collection Pipeline

7. LLM Reasoning Engine

Design

System Prompt (V0id Persona)

Structured Output Schema

Confidence Calibration

Model Configuration

8. Data Flow

End-to-End Alert Processing

Connector Integration Map

9. Neo4j Schema

Node Labels (17)

Constraints (17 uniqueness)

Indexes (28)

10. API Reference

Authentication

Endpoints (38 REST + 1 WebSocket)

Health & Status

Agent Control

Alert Ingestion

Decisions & Actions

Incidents

Hunts

Playbooks

Detection Engineering

Forensics

Claude AI

Graph & Admin

11. UI Architecture

Window System

Theme

Window Persistence

12. Deployment Architecture

Production Topology

Caddy Routing (ninjav0id.io)

Docker Compose (Production)

Deployment Commands

13. Configuration Reference

Autonomy & Agents

LLM Reasoning

Connectors

Detection Engineering

Playbooks & Incidents

Forensics

Infrastructure

14. ANTOS — DevSecOps Pipeline

Overview

Architecture

Key Features

Deployment

File Tree

Summary Statistics