# AEGIS-VAULT CTI Platform

**Category**: SECURITY_SERVICES  
**Publisher**: CyberSecur Global (AF-CSG-001)  
**Status**: PUBLISHED  
**Version**: 0.1.0  
**Slug**: `phoenix-aegis-vault-cti`

## Overview

AEGIS-VAULT is a defensive external threat intelligence and dark-web exposure monitoring platform. It answers six Priority Intelligence Requirements (PIRs) for financial-sector and sovereign cloud tenants without exposing analysts to unnecessary legal or operational risk.

## SKUs

| SKU | Tier | Profile | Highlights |
|-----|------|---------|------------|
| `aegis-vault-essentials` | Essentials | A | 50 watchlist assets, OSINT feeds, 30-day evidence |
| `aegis-vault-professional` | Professional | B | OpenCTI, TheHive, MinIO WORM, 1 commercial feed |
| `aegis-vault-enterprise` | Enterprise | C | MISP, Wazuh/Elastic, Cortex, multi-feed, SOC SLA |

## Key Features

- **PIR-driven alerts** — access brokers, credentials, documents, CVEs, brand abuse, vendor risk
- **Evidence vault** — SHA-256 hashing, MinIO object lock, chain of custody
- **Hard rules** — no credential testing, no broker contact, no CTI admin path to banking core
- **Case workflows** — NIST SP 800-61 Rev. 3 playbooks in TheHive
- **Compliance** — NIST CSF 2.0, Cyber Risk Institute Profile

## API Endpoints

### Health

```http
GET /health
```

### Watchlist

```http
POST /tenants/{tenantId}/watchlists
Content-Type: application/json

{
  "domains": ["example.d-bis.org"],
  "brands": ["DBIS"],
  "stackTerms": ["Proxmox", "SonicWall"]
}
```

### Alerts

```http
GET /tenants/{tenantId}/alerts
POST /tenants/{tenantId}/alerts
```

### Policy gate

```http
POST /policy/check
Content-Type: application/json

{ "action": "rotate credentials for affected VPN accounts" }
```

## Entitlements

- `AEGIS_VAULT_ESSENTIALS`
- `AEGIS_VAULT_PRO`
- `AEGIS_VAULT_ENTERPRISE`

## Pricing

- **Essentials**: $299/mo + usage (assets, alerts, evidence GB)
- **Professional**: $999/mo hybrid
- **Enterprise**: Contract / PO via [CyberSecur intake](https://cybersecur.d-bis.org/intake.html)

## Deployment

Proxmox manifest: `config/aegis-vault-cti-marketplace.v1.json`  
Onboarding: `docs/03-deployment/AEGIS_VAULT_MARKETPLACE_TENANT_ONBOARDING_RUNBOOK.md`
