SS-28 · SecOps & Threat Detection
The threat plane that watches the fabric. Versioned detections-as-code, Tetragon host sensors and Zeek network sensors feeding one case pipeline, dual-control containment, threat-intel feeds and screening, hunts that promote to rules, and — the mesh-native part — a Zeek auditor that SPAN-taps a mesh segment to prove the control plane never leaked a private key and to profile MTU/fragmentation on the overlay.
What it does
Zeek SPAN/mirror sensors on a mesh segment run a control-plane leak audit (POST /zeek/leak-audit → HIGH finding if a private key is ever seen) and an MTU/fragmentation profile (POST /zeek/mtu-profile → MEDIUM outside the clamp) — the network-side proof of the zero-knowledge invariant.
Publish versioned, immutable detection rules (SEC03) — re-publishing an id appends a new version instead of mutating; auto-disabled noisy rules can be re-enabled.
Register Zeek sensors on segments/taps, ingest protocol logs and notices, match observations against Intel-framework feeds, and report monitoring coverage by segment.
Findings roll into cases with evidence, enrichment and a war-room bridge; containment is dual-control — a containment is created, approved, then executed or released.
Manage intel feeds, screen an observable against them, and run threat hunts that promote a positive hunt into a standing detection rule.
Worked examples
Auth on every call is the platform standard: an SS-01 Bearer token plus your X-Tenant-Id. $BASE is the service's /api/v1 base; ${H[@]} carries the auth headers.
Point a Zeek sensor at a mesh segment tap, then ask it to prove the control-plane session never carried private-key material. A leak raises a HIGH finding into the same case pipeline as host detections.
# Register a Zeek sensor on the mesh tap
curl -sX POST "$BASE/zeek/sensors" "${H[@]}" \
-d '{ "segment":"mesh-1", "tap":"span0", "mode":"mirror" }'
# Audit a coordination session for a private-key leak
curl -sX POST "$BASE/zeek/leak-audit" "${H[@]}" \
-d '{ "mesh":"mesh-1", "session":"coord-9f" }'
# → { "leak": false, "finding": null, "scanned_bytes": 20480 }
# Profile MTU/fragmentation on the overlay (MEDIUM outside 1280–1420)
curl -sX POST "$BASE/zeek/mtu-profile" "${H[@]}" -d '{ "mesh":"mesh-1" }'
# → { "path_mtu": 1420, "fragmented": false, "finding": null }Detections are code: rules are versioned and immutable. Screening an observable against intel feeds returns a verdict you can attach to a case.
curl -sX POST "$BASE/rules" "${H[@]}" -d '{
"id":"mesh-rekey-storm", "name":"Rekey storm on a mesh", "severity":"high"
}'
# re-publishing the same id appends v2 — the old version is preserved
curl -sX POST "$BASE/intel/screen" "${H[@]}" \
-d '{ "type":"ip", "value":"203.0.113.9" }'
# → { "match": true, "feeds":["abuse.ch"], "score": 88 }Endpoints
Method · path from services/28's openapi.json. The complete catalog for every group is on the docs page.
/api/v1/zeek/leak-auditAudit a mesh control-plane session for a zero-knowledge leak (HIGH finding)/api/v1/zeek/leak-auditList mesh control-plane leak-audit results/api/v1/zeek/mtu-profileProfile mesh transit MTU/fragmentation (MEDIUM finding outside the clamp)/api/v1/zeek/coverageNetwork-monitoring coverage by segment/api/v1/zeek/sensorsRegister a Zeek network sensor on a segment/tap/api/v1/zeek/noticesIngest a Zeek notice (raises a network finding)/api/v1/zeek/intel-matchMatch a Zeek Intel-framework observation against feeds/api/v1/rulesPublish a detection rule (append-versioned)/api/v1/rules/{id}/reenableRe-enable an auto-disabled rule/api/v1/eventsIngest a detection event/api/v1/findings/{id}Get a finding/api/v1/cases/{id}Get a case with evidence + enrichment/api/v1/cases/{id}/containmentsCreate a containment on a case/api/v1/containments/{id}/approveApprove a containment (dual-control)/api/v1/containments/{id}/executeExecute an approved containment/api/v1/intel/screenScreen an observable against intel feeds/api/v1/huntsStart a threat hunt/api/v1/hunts/{id}/promotePromote a hunt to a standing rule/api/v1/cde/assessmentRun a CDE segmentation assessmentArchitecture placement
SS-28 attaches sensors to the same segments the mesh runs on: Zeek network sensors mirror a mesh tap, Tetragon watches the hosts, and both raise findings into one case pipeline. The mesh chaos-rig auditor (§29.10) runs the zero-knowledge leak audit and MTU/fragmentation profile directly against SS-26 overlay traffic. Containment is dual-control (approve → execute) and every action is audit-chained to SS-06.
Keep exploring
ZTNA, the sovereign mesh, native WireGuard coordination, SD-WAN and the UPO policy compiler — one fabric.
Open deep-dive →Authoritative DNS, GeoDNS steering, health-checked answers and a DNSSEC ceremony — the resolution layer under the mesh.
Open deep-dive →The Envoy edge in front of the whole fabric: TLS, JWT, WAF, rate-limits, routes and weighted canaries.
Open deep-dive →Metrics, logs, traces, SLOs with burn-rate routing, synthetic probes and the signed audit index for the whole fabric.
Open deep-dive →