Security & WAF (SS-07 Gateway · SS-28 SecOps)

What it does

Security & WAF

Two services form the security spine. SS-07 is the gateway: TLS, admission, entitlements, and routing with weighted versions — the policy every external call passes through. SS-27's edge WAF runs at parity with it and adds volumetric DDoS scrubbing at the PoPs. SS-28 is SecOps: Tetragon host and Zeek network sensors feeding detections-as-code, hunts you can promote to rules, cases with evidence and enrichment, and containment that is proposed, approved, then executed — guard-railed, never automatic.

Sub-capabilities

The real surface, grouped.

Gateway admission & entitlements (SS-07)

Admit requests against policy, resolve entitlements, and manage routes with weighted versions and webhook providers — the governed perimeter in front of every service.

Edge WAF & DDoS scrubbing (SS-27)

An edge WAF at gateway parity with per-class rules and exceptions, plus volumetric scrubbing at the PoPs and signed-URL verification for protected assets.

Detections-as-code (SS-28)

Author detection rules with versions, re-enable tuned rules, read coverage, and work a tuning queue — detections are code, reviewed and versioned like everything else.

Sensors & hunts

Tetragon host sensors and Zeek network sensors with heartbeats and health; ingest events; run threat hunts and promote a hunt to a standing rule.

Cases, evidence & guard-railed containment

Open cases with enrichment and attached evidence (incl. Zeek flow/pcap); propose a containment, require approval, then execute or release it — a bridge can be opened for coordinated response.

Zeek network monitoring & leak-audit

Query the Zeek protocol-log index, match observations against intel feeds, profile mesh MTU/fragmentation, and leak-audit the mesh control plane — raising HIGH/CRITICAL findings on a zero-knowledge violation.

Endpoints

Real method + path — SS-07 Gateway · SS-28 SecOps.

A representative slice of the 65 operations on SS-07 · SS-28. Base: https://api.edge.nexocloud.io/api/v1. Auth is an SS-01 bearer token plus X-Tenant-Id.

POST/api/v1/admitSS-07 — admit a request against gateway policy.

POST/api/v1/entitlementsSS-07 — resolve entitlements.

POST/api/v1/routes/weightsSS-07 — set weighted route versions.

PUT/api/v1/waf/classes/{class}SS-27 — upsert an edge WAF class.

POST/api/v1/waf/exceptionsSS-27 — add a WAF exception.

POST/api/v1/rulesSS-28 — author a detection rule.

GET/api/v1/rules/{id}/versionsSS-28 — list a rule's versions.

GET/api/v1/coverageSS-28 — detection coverage.

POST/api/v1/huntsSS-28 — run a threat hunt.

POST/api/v1/hunts/{id}/promoteSS-28 — promote a hunt to a rule.

POST/api/v1/cases/{id}/evidenceSS-28 — attach evidence to a case.

POST/api/v1/cases/{id}/containmentsSS-28 — propose a containment.

POST/api/v1/containments/{id}/approveSS-28 — approve a containment.

POST/api/v1/containments/{id}/executeSS-28 — execute an approved containment.

POST/api/v1/zeek/leak-auditSS-28 — leak-audit a mesh control-plane session.

POST/api/v1/zeek/intel-matchSS-28 — match an observation against intel feeds.

Full endpoint catalog →

Worked example

From a Zeek notice to a guard-railed containment

Detection is code; response is governed. A network notice raises a finding, opens a case, and a containment must be approved before it can execute.

SS-07 Gateway · SS-28 SecOps · bash

# 1. A Zeek notice is ingested and raises a network finding
curl -X POST "$BASE/zeek/notices" -H "$AUTH" -H "$TENANT" \
  -d '{"note":"C2 beacon","src":"10.2.0.9","severity":"high"}'
#  → { "finding_id": "fnd_88", "case_id": "case_41" }

# 2. Enrich the case and attach flow/pcap evidence
curl -X POST "$BASE/cases/case_41/enrichment" -H "$AUTH" -H "$TENANT" \
  -d '{"source":"intel","observable":"10.2.0.9"}'
curl -X POST "$BASE/zeek/cases/case_41/evidence" -H "$AUTH" -H "$TENANT" \
  -d '{"kind":"flow","ref":"conn.log#..."}'

# 3. Propose containment — it does NOT execute until approved
curl -X POST "$BASE/cases/case_41/containments" -H "$AUTH" -H "$TENANT" \
  -d '{"action":"isolate-host","target":"10.2.0.9"}'
#  → { "containment_id": "cnt_5", "state": "proposed" }

curl -X POST "$BASE/containments/cnt_5/approve" -H "$AUTH" -H "$TENANT"
curl -X POST "$BASE/containments/cnt_5/execute" -H "$AUTH" -H "$TENANT"
#  → { "state": "executed" }   # release later: POST /containments/cnt_5/release

Containment is proposed → approved → executed, with an explicit release — never a silent auto-block. Every step is a tenant-scoped, signed audit entry.

Architecture placement