Every detection HAIEC ships.

166 of 166 rules

• K8S-001Container settingsExecutableLOG

  A pod is running as the root user

  Evidence: Kubernetes pod spec

  Container settings decide what code can reach host resources.

  Never claims: PRIVILEGED_POD != ATTACK

  Remediation: PB-CONTAINER-ROOT — see playbooks

• K8S-002Container settingsExecutableLOG

  A container has a privileged security context

  Evidence: Kubernetes pod spec

  Container settings decide what code can reach host resources.

  Never claims: PRIVILEGED_POD != ATTACK

  Remediation: PB-CONTAINER-ROOT — see playbooks

• K8S-003Container settingsExecutableLOG

  A service account holds cluster-admin role

  Evidence: RBAC bindings

  Container settings decide what code can reach host resources.

  Never claims: MISSING_NETWORK_POLICY != BREACH

  Remediation: PB-CONTAINER-ROOT — see playbooks

• K8S-004Container settingsExecutableLOG

  No network policy covers a sensitive workload

  Evidence: Kubernetes manifests

  Container settings decide what code can reach host resources.

  Never claims: MISSING_NETWORK_POLICY != BREACH

  Remediation: PB-CONTAINER-ROOT — see playbooks

• K8S-005Container settingsExecutableLOG

  A secret is mounted without encryption

  Evidence: Kubernetes pod spec

  Container settings decide what code can reach host resources.

  Never claims: HARDCODED_SECRET != EXPLOITED

  Remediation: PB-CONTAINER-ROOT — see playbooks

• K8S-006Container settingsExecutableLOG

  Pod exec/attach came from an unexpected principal

  Evidence: Kubernetes audit log

  Container settings decide what code can reach host resources.

  Never claims: AUTH_FAILURE != ATTACK

  Remediation: PB-CONTAINER-ROOT — see playbooks

• K8S-007Container settingsExecutableLOG

  Pod uses host network, PID, or IPC access

  Evidence: Kubernetes pod spec

  Container settings decide what code can reach host resources.

  Never claims: PRIVILEGED_POD != ATTACK

  Remediation: PB-CONTAINER-ROOT — see playbooks

• API-001Sign-in and tokensExecutableLOG

  Repeated 401/403 responses from the same principal

  Evidence: API access logs

  Unusual sign-in or token use can expose customer data or block service.

  Never claims: AUTH_FAILURE != ATTACK

• API-002Sign-in and tokensExecutableLOG

  Many different accounts tried from the same IP address

  Evidence: API access logs

  Unusual sign-in or token use can expose customer data or block service.

  Never claims: AUTH_FAILURE != ATTACK

• API-003Sign-in and tokensExecutableLOG

  An API key was used from an unusual location

  Evidence: API access logs

  Unusual sign-in or token use can expose customer data or block service.

  Never claims: GEO_UNUSUAL != MALICIOUS

• API-004Sign-in and tokensExecutableLOG

  Rate limit exceeded repeatedly

  Evidence: Gateway logs

  Unusual sign-in or token use can expose customer data or block service.

  Never claims: AUTH_FAILURE != ATTACK

• API-005Sign-in and tokensExecutableLOG

  A deprecated authentication method is still in use

  Evidence: API access logs

  Unusual sign-in or token use can expose customer data or block service.

  Never claims: DEFAULT_CHANGE != ATTACK

• API-006Sign-in and tokensExecutableLOG

  The same token was used across tenant boundaries

  Evidence: API access logs

  Unusual sign-in or token use can expose customer data or block service.

  Never claims: CROSS_TENANT != ATTACK

• DNS-001Network name lookupsExecutableLOG

  Subdomain queries carry unusually high entropy

  Evidence: DNS logs

  Odd name lookups can hide data leaving the network or attacker infrastructure.

  Never claims: HIGH_ENTROPY != TUNNELING

• DNS-002Network name lookupsExecutableLOG

  A CNAME points to an untrusted registrar

  Evidence: DNS zone data

  Odd name lookups can hide data leaving the network or attacker infrastructure.

  Never claims: HIGH_ENTROPY != TUNNELING

• DNS-003Network name lookupsExecutableLOG

  A zone transfer was attempted

  Evidence: DNS logs

  Odd name lookups can hide data leaving the network or attacker infrastructure.

  Never claims: NXDOMAIN != ATTACK

• DNS-004Network name lookupsExecutableLOG

  A flood of NXDOMAIN responses from one source

  Evidence: DNS logs

  Odd name lookups can hide data leaving the network or attacker infrastructure.

  Never claims: NXDOMAIN != ATTACK

• DNS-005Network name lookupsExecutableLOG

  A stable name resolved with an unusually short TTL

  Evidence: DNS logs

  Odd name lookups can hide data leaving the network or attacker infrastructure.

  Never claims: HIGH_ENTROPY != TUNNELING

• CERT-001CertificatesRegister-onlyTELEMETRY

  An expired certificate is still active on an endpoint

  Evidence: TLS inspection

  Weak or expired certificates let outsiders intercept or fake trusted connections.

  Never claims: EXPIRED_CERT != COMPROMISED

  Remediation: PB-CERT-EXPIRED — see playbooks

• CERT-002CertificatesRegister-onlyTELEMETRY

  A certificate issuer changed without a recorded change

  Evidence: TLS inspection

  Weak or expired certificates let outsiders intercept or fake trusted connections.

  Never claims: EXPIRED_CERT != COMPROMISED

  Remediation: PB-CERT-EXPIRED — see playbooks

• CERT-003CertificatesRegister-onlyTELEMETRY

  A public endpoint presents a self-signed certificate

  Evidence: TLS inspection

  Weak or expired certificates let outsiders intercept or fake trusted connections.

  Never claims: SELF_SIGNED != MALICIOUS

  Remediation: PB-CERT-EXPIRED — see playbooks

• CERT-004CertificatesRegister-onlyTELEMETRY

  A revoked certificate is still being presented

  Evidence: TLS inspection + CRL/OCSP

  Weak or expired certificates let outsiders intercept or fake trusted connections.

  Never claims: EXPIRED_CERT != COMPROMISED

  Remediation: PB-CERT-EXPIRED — see playbooks

• CERT-005CertificatesRegister-onlyTELEMETRY

  A certificate uses a weak signature algorithm

  Evidence: TLS inspection

  Weak or expired certificates let outsiders intercept or fake trusted connections.

  Never claims: SELF_SIGNED != MALICIOUS

  Remediation: PB-CERT-EXPIRED — see playbooks

• TIME-001Clock driftRegister-onlyTELEMETRY

  The time source changed without a matching config update

  Evidence: NTP configuration

  Wrong clocks break audit trails and can hide when events really happened.

  Never claims: CLOCK_DRIFT != ATTACK

  Remediation: PB-CLOCK-DRIFT — see playbooks

• TIME-002Clock driftRegister-onlyTELEMETRY

  Clocks on different sources disagree beyond the threshold

  Evidence: Time sync telemetry

  Wrong clocks break audit trails and can hide when events really happened.

  Never claims: CLOCK_DRIFT != ATTACK

  Remediation: PB-CLOCK-DRIFT — see playbooks

• TIME-003Clock driftRegister-onlyTELEMETRY

  An event carries a timestamp in the future

  Evidence: Event timestamps

  Wrong clocks break audit trails and can hide when events really happened.

  Never claims: TIME_REGRESSION != SPOOFING

  Remediation: PB-CLOCK-DRIFT — see playbooks

• TIME-004Clock driftRegister-onlyTELEMETRY

  Events arrived out of order by timestamp

  Evidence: Event timestamps

  Wrong clocks break audit trails and can hide when events really happened.

  Never claims: TIME_REGRESSION != SPOOFING

  Remediation: PB-CLOCK-DRIFT — see playbooks

• TIME-005Clock driftRegister-onlyTELEMETRY

  Multiple time sources disagree

  Evidence: Time sync telemetry

  Wrong clocks break audit trails and can hide when events really happened.

  Never claims: CLOCK_DRIFT != ATTACK

  Remediation: PB-CLOCK-DRIFT — see playbooks

• MSG-001Message trafficExecutableLOG

  A producer published to a topic it never declared

  Evidence: Message bus logs

  Unexpected message traffic can move data or commands where they do not belong.

  Never claims: UNDECLARED_TOPIC != COMPROMISE

  Remediation: PB-BUS-UNDECLARED — see playbooks

• MSG-002Message trafficExecutableLOG

  A consumer subscribed to an unexpected topic

  Evidence: Message bus logs

  Unexpected message traffic can move data or commands where they do not belong.

  Never claims: UNDECLARED_TOPIC != COMPROMISE

  Remediation: PB-BUS-UNDECLARED — see playbooks

• MSG-003Message trafficExecutableLOG

  A message is far larger than the baseline pattern

  Evidence: Message bus metrics

  Unexpected message traffic can move data or commands where they do not belong.

  Never claims: SCHEMA_MISMATCH != ATTACK

  Remediation: PB-BUS-UNDECLARED — see playbooks

• MSG-004Message trafficExecutableLOG

  Message rate spiked above baseline

  Evidence: Message bus metrics

  Unexpected message traffic can move data or commands where they do not belong.

  Never claims: UNDECLARED_TOPIC != COMPROMISE

  Remediation: PB-BUS-UNDECLARED — see playbooks

• MSG-005Message trafficExecutableLOG

  A message does not match the declared schema

  Evidence: Schema registry

  Unexpected message traffic can move data or commands where they do not belong.

  Never claims: SCHEMA_MISMATCH != ATTACK

  Remediation: PB-BUS-UNDECLARED — see playbooks

• MSG-006Message trafficExecutableLOG

  The dead-letter queue is growing past the threshold

  Evidence: Queue metrics

  Unexpected message traffic can move data or commands where they do not belong.

  Never claims: SCHEMA_MISMATCH != ATTACK

  Remediation: PB-BUS-UNDECLARED — see playbooks

• SEC-001Exposed credentialsExecutableSTATIC

  A secret value appears in source code

  Evidence: Static source scan

  Exposed credentials give whoever finds them the same access as the real key.

  Never claims: HARDCODED_SECRET != EXPLOITED

  Remediation: PB-CRED-LEAK — see playbooks

• SEC-002Exposed credentialsExecutableSTATIC

  An environment file was committed to the repo

  Evidence: Repo file inventory

  Exposed credentials give whoever finds them the same access as the real key.

  Never claims: HARDCODED_SECRET != EXPLOITED

  Remediation: PB-CRED-LEAK — see playbooks

• SEC-003Exposed credentialsExecutableSTATIC

  A secret-bearing environment variable appeared in logs

  Evidence: Log inspection

  Exposed credentials give whoever finds them the same access as the real key.

  Never claims: HARDCODED_SECRET != EXPLOITED

  Remediation: PB-CRED-LEAK — see playbooks

• SEC-004Exposed credentialsExecutableSTATIC

  A secret is older than the rotation policy allows

  Evidence: Secret metadata

  Exposed credentials give whoever finds them the same access as the real key.

  Never claims: ROTATION_LATE != BREACH

  Remediation: PB-CRED-LEAK — see playbooks

• SEC-005Exposed credentialsExecutableSTATIC

  A secret was read by a principal that never declared it

  Evidence: Secret access logs

  Exposed credentials give whoever finds them the same access as the real key.

  Never claims: HARDCODED_SECRET != EXPLOITED

  Remediation: PB-CRED-LEAK — see playbooks

• DRIFT-001Config changesExecutableCONFIG

  A config file changed without a change request

  Evidence: Config history

  Unrecorded config changes can quietly weaken a control everyone relies on.

  Never claims: DRIFT != COMPROMISE

  Remediation: PB-POLICY — see playbooks

• DRIFT-002Config changesExecutableCONFIG

  A declared value no longer matches the observed value

  Evidence: Config vs runtime read

  Unrecorded config changes can quietly weaken a control everyone relies on.

  Never claims: DRIFT != COMPROMISE

  Remediation: PB-POLICY — see playbooks

• DRIFT-003Config changesExecutableCONFIG

  A default value changed from the approved baseline

  Evidence: Config history

  Unrecorded config changes can quietly weaken a control everyone relies on.

  Never claims: DEFAULT_CHANGE != ATTACK

  Remediation: PB-POLICY — see playbooks

• DRIFT-004Config changesExecutableCONFIG

  A feature flag was toggled without an approval record

  Evidence: Flag audit log

  Unrecorded config changes can quietly weaken a control everyone relies on.

  Never claims: DRIFT != COMPROMISE

  Remediation: PB-POLICY — see playbooks

• DATA-001Data accessExecutableLOG

  A large volume of sensitive records was read at once

  Evidence: Data access logs

  Bulk or cross-tenant reads can become a reportable data exposure.

  Never claims: BULK_READ != EXFILTRATION

  Remediation: PB-DATA-BULK — see playbooks

• DATA-002Data accessExecutableLOG

  A query scanned a full table instead of using an index

  Evidence: Query telemetry

  Bulk or cross-tenant reads can become a reportable data exposure.

  Never claims: BULK_READ != EXFILTRATION

  Remediation: PB-DATA-BULK — see playbooks

• DATA-003Data accessExecutableLOG

  Data was read by a principal that never declared it

  Evidence: Data access logs

  Bulk or cross-tenant reads can become a reportable data exposure.

  Never claims: AUTH_FAILURE != ATTACK

  Remediation: PB-DATA-BULK — see playbooks

• DATA-004Data accessExecutableLOG

  Data belonging to another tenant was accessed

  Evidence: Data access logs

  Bulk or cross-tenant reads can become a reportable data exposure.

  Never claims: CROSS_TENANT != ATTACK

  Remediation: PB-DATA-BULK — see playbooks

• DATA-005Data accessExecutableLOG

  An export moved an unusual volume of data

  Evidence: Export logs

  Bulk or cross-tenant reads can become a reportable data exposure.

  Never claims: BULK_READ != EXFILTRATION

  Remediation: PB-DATA-BULK — see playbooks

• AI-001Agent actionsRegister-onlyTRACE

  An agent invoked a model outside its declared set

  Evidence: Agent runtime telemetry

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: UNREGISTERED_SERVICE != ROGUE_NF

• AI-002Agent actionsExecutableTRACE

  An agent used a tool it never declared

  Evidence: Tool-call telemetry

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: TOOL_REGISTERED != TOOL_EXECUTED

• AI-003Agent actionsExecutableTRACE

  An agent wrote to memory outside its declared scope

  Evidence: Memory access logs

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: CROSS_SESSION_READ != MEMORY_CONTAMINATION

• AI-004Agent actionsExecutableTRACE

  An agent delegated to another agent with no recorded…

  Evidence: Delegation records

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: HANDOFF != DELEGATION

• AI-005Agent actionsExecutableTRACE

  An agent handed work to an agent with no registered identity

  Evidence: Handoff logs

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: UNREGISTERED_SERVICE != ROGUE_NF · MESH_TRAFFIC != LATERAL_MOVEMENT

• AI-006Agent actionsRegister-onlyTRACE

  A prompt template changed without a change record

  Evidence: Prompt/config history

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: PROMPT_HASH_CHANGE != PROMPT_DRIFT_MALICIOUS · POLICY_CHANGED != POLICY_MANIPULATED

• AI-007Agent actionsExecutableTRACE

  An agent contacted a tool server not in the registry

  Evidence: Tool-call telemetry

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: UNREGISTERED_SOURCE != ATTACK

• AI-008Agent actionsExecutableTRACE

  Context was pulled from a knowledge source that was never…

  Evidence: Retrieval logs

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: OOD_DETECTED != ADVERSARIAL_ATTACK

• AI-009Agent actionsRegister-onlyTRACE

  An agent exceeded its declared step or action budget

  Evidence: Agent runtime telemetry

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: HIGH_QUERY_RATE != MODEL_EXTRACTION · CALL_FLOW_DEVIATION != ATTACK

• AI-010Agent actionsRegister-onlyTRACE

  An agent acted for a user with no matching session record

  Evidence: Session/delegation records

  Agent behavior outside its declared envelope can act with credentials it should not have.

  Never claims: AUTH_FAILURE != ATTACK

• SC-001Supply chainExecutableSC

  A dependency version changed without a change record

  Evidence: Lockfile/SBOM diff

  A changed dependency or artifact can ship code nobody approved.

  Never claims: DRIFT != COMPROMISE

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• SC-002Supply chainExecutableSC

  A package in the bill of materials carries a known…

  Evidence: SBOM vs vulnerability feed

  A changed dependency or artifact can ship code nobody approved.

  Never claims: VULNERABLE_PACKAGE != EXPLOITED

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• SC-003Supply chainExecutableSC

  A dependency appeared that is not in the declared bill of…

  Evidence: SBOM vs lockfile

  A changed dependency or artifact can ship code nobody approved.

  Never claims: VULNERABLE_PACKAGE != EXPLOITED · DRIFT != COMPROMISE

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• SC-004Supply chainExecutableSC

  A built artifact does not match the recorded bill of…

  Evidence: Build provenance

  A changed dependency or artifact can ship code nobody approved.

  Never claims: PIPELINE_MODIFIED != COMPROMISE

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• SC-005Supply chainExecutableSC

  A dependency was pulled from an unapproved registry

  Evidence: Package install logs

  A changed dependency or artifact can ship code nobody approved.

  Never claims: UNREGISTERED_SOURCE != ATTACK

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• SC-006Supply chainExecutableSC

  An exploitability statement downgraded a vulnerability with…

  Evidence: VEX/CSAF records

  A changed dependency or artifact can ship code nobody approved.

  Never claims: VULNERABLE_PACKAGE != EXPLOITED

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• SC-007Supply chainExecutableSC

  A package publisher or maintainer changed

  Evidence: Registry metadata

  A changed dependency or artifact can ship code nobody approved.

  Never claims: MISSING_SIGNATURE != MALICIOUS_ARTIFACT

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• SC-008Supply chainExecutableSC

  A transitive dependency gained new network permissions

  Evidence: Dependency manifest diff

  A changed dependency or artifact can ship code nobody approved.

  Never claims: VULNERABLE_PACKAGE != EXPLOITED

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• CICD-001Build pipelineRegister-onlyCONFIG

  A pipeline definition changed without a change request

  Evidence: Pipeline config history

  Pipeline changes decide what code actually reaches production.

  Never claims: PIPELINE_MODIFIED != COMPROMISE

  Remediation: PB-POLICY — see playbooks

• CICD-002Build pipelineRegister-onlyCONFIG

  A pipeline ran from an unexpected trigger or branch

  Evidence: Pipeline run logs

  Pipeline changes decide what code actually reaches production.

  Never claims: PIPELINE_MODIFIED != COMPROMISE

  Remediation: PB-POLICY — see playbooks

• CICD-003Build pipelineRegister-onlyCONFIG

  A pipeline accessed a secret it never declared

  Evidence: Pipeline audit logs

  Pipeline changes decide what code actually reaches production.

  Never claims: HARDCODED_SECRET != EXPLOITED

  Remediation: PB-POLICY — see playbooks

• CICD-004Build pipelineRegister-onlyCONFIG

  A pipeline deployed to an environment outside its declared…

  Evidence: Deploy records

  Pipeline changes decide what code actually reaches production.

  Never claims: PIPELINE_MODIFIED != COMPROMISE

  Remediation: PB-POLICY — see playbooks

• CICD-005Build pipelineRegister-onlyCONFIG

  A pipeline step ran with broader permissions than declared

  Evidence: Pipeline config vs run

  Pipeline changes decide what code actually reaches production.

  Never claims: PRIVILEGED_POD != ATTACK

  Remediation: PB-POLICY — see playbooks

• PROMPT-001Prompt inputExecutableTRACE

  Prompt text asks the model to reveal its system instructions

  Evidence: Agent prompt events (gen_ai.* attributes)

  Prompt input can steer the agent outside the task it was given.

  Never claims: USER_QUERY != PROMPT_INJECTION · PROMPT != COMMAND

• PROMPT-002Prompt inputExecutableTRACE

  Prompt text matches a known jailbreak pattern

  Evidence: Agent prompt events

  Prompt input can steer the agent outside the task it was given.

  Never claims: USER_QUERY != PROMPT_INJECTION · INSTRUCTION_LIKE != ATTACK

• PROMPT-003Prompt inputExecutableTRACE

  A later conversation turn uses "established fact" phrasing…

  Evidence: Agent prompt events with turn position

  Prompt input can steer the agent outside the task it was given.

  Never claims: USER_QUERY != PROMPT_INJECTION · MULTI_TURN != MANIPULATION

• PROMPT-004Prompt inputExecutableTRACE

  Prompt text tries to override prior instructions

  Evidence: Agent prompt events

  Prompt input can steer the agent outside the task it was given.

  Never claims: INSTRUCTION_LIKE != ATTACK · USER_QUERY != PROMPT_INJECTION

• PROMPT-005Prompt inputExecutableTRACE

  Input context exceeds the declared context limit

  Evidence: Agent prompt events with context size

  Prompt input can steer the agent outside the task it was given.

  Never claims: CONTEXT_OVERFLOW != ATTACK

• RAG-001Retrieved contentExecutableTRACE

  A retrieved chunk came from a source outside the declared…

  Evidence: Retrieval events + declared knowledge-source registry

  Retrieved content can carry instructions the user never approved.

  Never claims: RETRIEVED != TRUSTED · UNTRUSTED_SOURCE != POISONED

• RAG-002Retrieved contentExecutableTRACE

  A retrieved chunk contains instruction-like text

  Evidence: Retrieval chunk text

  Retrieved content can carry instructions the user never approved.

  Never claims: RETRIEVED != TRUSTED · INSTRUCTION_LIKE != ATTACK

• RAG-003Retrieved contentExecutableTRACE

  Retrieved-set embedding signature differs from the declared…

  Evidence: Retrieval events + declared embedding signature

  Retrieved content can carry instructions the user never approved.

  Never claims: EMBEDDING_DRIFT != POISONED

• RAG-004Retrieved contentExecutableTRACE

  A chunk from one session surfaced in a different session

  Evidence: Retrieval events with session ids

  Retrieved content can carry instructions the user never approved.

  Never claims: CROSS_SESSION != CONTAMINATION

• MEM-001Agent memoryExecutableTRACE

  A memory write arrived through an undeclared channel

  Evidence: Memory operations + declared channel list

  Shared memory can leak data between sessions or agents.

  Never claims: MEMORY_ACCESS != CONTAMINATION · UNDECLARED_CHANNEL != POISONED

• MEM-002Agent memoryExecutableTRACE

  A memory access touched a scope outside the declared scopes

  Evidence: Memory operations + declared scope list

  Shared memory can leak data between sessions or agents.

  Never claims: MEMORY_ACCESS != CONTAMINATION · OUTSIDE_SCOPE != EXFILTRATION

• MULTI-001Agent handoffsExecutableTRACE

  Two agents handed control back and forth in a loop

  Evidence: Agent handoff records per session

  Agents passing work can silently widen what the system is allowed to do.

  Never claims: AGENT_SEQUENCE != COORDINATION_ANOMALY · LOOP_DETECTED != INFINITE_LOOP

• MULTI-002Agent handoffsExecutableTRACE

  An agent handoff happened without a declared handoff

  Evidence: Agent handoff records + declared handoff flags

  Agents passing work can silently widen what the system is allowed to do.

  Never claims: AGENT_SEQUENCE != COORDINATION_ANOMALY

• MULTI-003Agent handoffsExecutableTRACE

  A handoff target has no registered agent identity

  Evidence: Agent handoff records + registration flags

  Agents passing work can silently widen what the system is allowed to do.

  Never claims: UNREGISTERED != MALICIOUS

• MULTI-004Agent handoffsExecutableTRACE

  Different agents acted on the same target in one session

  Evidence: Agent handoff records per session and surface

  Agents passing work can silently widen what the system is allowed to do.

  Never claims: SHARED_TARGET != CONFLICT

• MCP-001Tool callsExecutableTRACE

  A tool was invoked that is not in the declared tool registry

  Evidence: Agent tool calls + declared tool registry

  Tool calls decide which external systems the agent can actually touch.

  Never claims: UNDECLARED_TOOL != MALICIOUS · TOOL_INVOKED != AUTHORIZED

• MCP-002Tool callsExecutableTRACE

  A call reached an MCP server outside the declared server…

  Evidence: Agent tool calls + declared server registry

  Tool calls decide which external systems the agent can actually touch.

  Never claims: UNDECLARED_TOOL != MALICIOUS

• MCP-003Tool callsExecutableTRACE

  A tool presented a schema version different from its…

  Evidence: Agent tool calls + registered tool schemas

  Tool calls decide which external systems the agent can actually touch.

  Never claims: SCHEMA_CHANGE != ATTACK

• MCP-004Tool callsExecutableTRACE

  A tool call came from an unregistered agent

  Evidence: Agent tool calls + declared agent registry

  Tool calls decide which external systems the agent can actually touch.

  Never claims: UNREGISTERED != MALICIOUS

• EXFIL-001Data leavingExecutableTRACE

  Model output matched a sensitive-content pattern…

  Evidence: Agent output events

  Output carrying secrets or personal data can leave the controlled boundary.

  Never claims: OUTPUT_CONTAINS_PII_PATTERN != LEAK · PATTERN_MATCH != EXFILTRATION

  Remediation: PB-EGRESS — see playbooks

• EXFIL-002Data leavingExecutableTRACE

  Model output contained text matching the system-prompt…

  Evidence: Agent output events + system-prompt signature

  Output carrying secrets or personal data can leave the controlled boundary.

  Never claims: OUTPUT_CONTAINS_PII_PATTERN != LEAK

  Remediation: PB-EGRESS — see playbooks

• EXFIL-003Data leavingExecutableTRACE

  A tool-call payload matched a sensitive-content pattern

  Evidence: Agent tool-call payloads

  Output carrying secrets or personal data can leave the controlled boundary.

  Never claims: PATTERN_MATCH != EXFILTRATION

  Remediation: PB-EGRESS — see playbooks

• EXFIL-004Data leavingExecutableTRACE

  A model-chain call reached a destination outside the egress…

  Evidence: Agent tool calls + egress allowlist

  Output carrying secrets or personal data can leave the controlled boundary.

  Never claims: EGRESS_OUTSIDE_ALLOWLIST != EXFILTRATION

  Remediation: PB-EGRESS — see playbooks

• COST-001Usage spikesExecutableTELEMETRY

  Token usage spiked above its declared baseline

  Evidence: Agent usage metrics + baselines

  Runaway usage burns budget and can signal a loop or extraction attempt.

  Never claims: TOKEN_SPIKE != ATTACK

• COST-002Usage spikesExecutableTELEMETRY

  Retry volume crossed the retry-storm threshold

  Evidence: Agent usage metrics

  Runaway usage burns budget and can signal a loop or extraction attempt.

  Never claims: RETRY_COUNT_HIGH != CASCADING_FAILURE

• COST-003Usage spikesExecutableTELEMETRY

  Token usage spiked inside a session containing an agent…

  Evidence: Agent usage metrics + handoff records

  Runaway usage burns budget and can signal a loop or extraction attempt.

  Never claims: TOKEN_SPIKE != ATTACK · LOOP_DETECTED != INFINITE_LOOP

• COST-004Usage spikesExecutableTELEMETRY

  A model call originated from an undeclared surface

  Evidence: Agent usage metrics + declared model-call surfaces

  Runaway usage burns budget and can signal a loop or extraction attempt.

  Never claims: UNDECLARED_SURFACE != COMPROMISE

• AGENT-AUTH-001Agent authorityExecutableTRACE

  An observed actor is not in the declared delegation chain

  Evidence: Delegation records vs declared chains

  Authority checks decide whether an agent acts beyond its grant.

  Never claims: ACTOR_MISMATCH != CONFUSED_DEPUTY

• AGENT-AUTH-002Agent authorityExecutableTRACE

  An observed scope exceeds the declared delegation scopes

  Evidence: Delegation records vs declared scopes

  Authority checks decide whether an agent acts beyond its grant.

  Never claims: SCOPE_MISMATCH != PRIVILEGE_ESCALATION

• AGENT-AUTH-003Agent authorityExecutableTRACE

  A tool-call actor appears in no declared delegation chain

  Evidence: Tool calls vs declared delegation chains

  Authority checks decide whether an agent acts beyond its grant.

  Never claims: ACTOR_MISMATCH != CONFUSED_DEPUTY

• RAPP-A1-001Network policyExecutableA1

  A policy diff exceeded the approved baseline threshold

  Evidence: A1 policy events + approved baseline

  Policy changes control how the network behaves for every user on it.

  Never claims: POLICY_CHANGED != POLICY_MANIPULATED

  Remediation: PB-POLICY — see playbooks

• RAPP-A1-002Network policyExecutableA1

  A policy came from an application that is not in the…

  Evidence: A1 policy events + registered applications

  Policy changes control how the network behaves for every user on it.

  Never claims: UNREGISTERED_SOURCE != ATTACK

  Remediation: PB-POLICY — see playbooks

• RAPP-A1-003Network policyExecutableA1

  Policy distribution divergence crossed the declared…

  Evidence: A1 policy distributions + threshold

  Policy changes control how the network behaves for every user on it.

  Never claims: POLICY_CHANGED != POLICY_MANIPULATED

  Remediation: PB-POLICY — see playbooks

• RAPP-A1-004Network policyExecutableA1

  A policy changed without a matching change request

  Evidence: A1 policy events + change requests

  Policy changes control how the network behaves for every user on it.

  Never claims: POLICY_CHANGED != POLICY_MANIPULATED

  Remediation: PB-POLICY — see playbooks

• RAPP-A1-005Network policyExecutableA1

  A policy targets a scope outside the issuing application…

  Evidence: A1 policy events + declared scopes

  Policy changes control how the network behaves for every user on it.

  Never claims: POLICY_CHANGED != POLICY_MANIPULATED · OUTSIDE_SCOPE != EXFILTRATION

  Remediation: PB-POLICY — see playbooks

• SBI-001Service callsExecutableSBI

  A consumer NF called a service outside its registered…

  Evidence: SBI call events + NF profiles

  Unexpected service calls can reach functions or data outside the intended boundary.

  Never claims: UNREGISTERED_SERVICE != ROGUE_NF

  Remediation: PB-SERVICE-DISCOVERY — see playbooks

• SBI-002Service callsExecutableSBI

  A call flow deviated from the recorded baseline pattern

  Evidence: SBI call events + baseline flows

  Unexpected service calls can reach functions or data outside the intended boundary.

  Never claims: CALL_FLOW_DEVIATION != ATTACK

  Remediation: PB-SERVICE-DISCOVERY — see playbooks

• SBI-003Service callsExecutableSBI

  A service-interface message failed schema validation

  Evidence: SBI message validation

  Unexpected service calls can reach functions or data outside the intended boundary.

  Never claims: SCHEMA_MISMATCH != ATTACK

  Remediation: PB-SERVICE-DISCOVERY — see playbooks

• SBI-004Service callsExecutableSBI

  A consumer function called without ever registering with…

  Evidence: SBI call events + registration registry

  Unexpected service calls can reach functions or data outside the intended boundary.

  Never claims: UNREGISTERED_SERVICE != ROGUE_NF

  Remediation: PB-SERVICE-DISCOVERY — see playbooks

• SBI-005Service callsExecutableSBI

  A call router sent traffic to a producer outside the…

  Evidence: SBI routing events + expected producers

  Unexpected service calls can reach functions or data outside the intended boundary.

  Never claims: CALL_FLOW_DEVIATION != ATTACK

  Remediation: PB-SERVICE-DISCOVERY — see playbooks

• SBI-006Service callsExecutableSBI

  Service discovery request rate crossed the declared…

  Evidence: Discovery request metrics + threshold

  Unexpected service calls can reach functions or data outside the intended boundary.

  Never claims: HIGH_QUERY_RATE != MODEL_EXTRACTION

  Remediation: PB-SERVICE-DISCOVERY — see playbooks

• SBI-007Service callsExecutableSBI

  A deregistered function was still active on the interface

  Evidence: SBI call events + registration registry

  Unexpected service calls can reach functions or data outside the intended boundary.

  Never claims: UNREGISTERED_SERVICE != ROGUE_NF

  Remediation: PB-SERVICE-DISCOVERY — see playbooks

• SBI-008Service callsExecutableSBI

  A service-interface call crossed slice boundaries

  Evidence: SBI call events + slice ids

  Unexpected service calls can reach functions or data outside the intended boundary.

  Never claims: CROSS_SLICE_TRAFFIC != ISOLATION_BREACH

  Remediation: PB-SERVICE-DISCOVERY — see playbooks

• SLICE-001Network slicesExecutableSLICE

  Traffic from one slice appeared on another slice

  Evidence: Slice traffic events

  Slice boundaries keep tenants and traffic separated; crossing them is a containment gap.

  Never claims: CROSS_SLICE_TRAFFIC != ISOLATION_BREACH

  Remediation: PB-SLICE-CROSS — see playbooks

• SLICE-002Network slicesExecutableSLICE

  A UE attached to a cell outside the slice RAN subnet

  Evidence: Slice attachment events + RAN subnets

  Slice boundaries keep tenants and traffic separated; crossing them is a containment gap.

  Never claims: CROSS_SLICE_TRAFFIC != ISOLATION_BREACH

  Remediation: PB-SLICE-CROSS — see playbooks

• SLICE-003Network slicesExecutableSLICE

  Slice resource usage exceeded its allocated quota

  Evidence: Slice usage metrics + quota

  Slice boundaries keep tenants and traffic separated; crossing them is a containment gap.

  Never claims: SLA_BREACH != ISOLATION_FAILURE

  Remediation: PB-SLICE-CROSS — see playbooks

• SLICE-004Network slicesExecutableSLICE

  A slice SLA metric breached its declared threshold

  Evidence: Slice SLA metrics

  Slice boundaries keep tenants and traffic separated; crossing them is a containment gap.

  Never claims: SLA_BREACH != ISOLATION_FAILURE

  Remediation: PB-SLICE-CROSS — see playbooks

• SLICE-005Network slicesExecutableSLICE

  A data access crossed tenant boundaries inside a slice

  Evidence: Slice data-access events

  Slice boundaries keep tenants and traffic separated; crossing them is a containment gap.

  Never claims: CROSS_TENANT != ATTACK · CROSS_SLICE_TRAFFIC != ISOLATION_BREACH

  Remediation: PB-SLICE-CROSS — see playbooks

• SLICE-006Network slicesExecutableSLICE

  A slice isolation policy was disabled or modified

  Evidence: Slice policy records

  Slice boundaries keep tenants and traffic separated; crossing them is a containment gap.

  Never claims: POLICY_CHANGED != POLICY_MANIPULATED

  Remediation: PB-SLICE-CROSS — see playbooks

• AML-001Model behaviorExecutableML

  A served model version differs from the approved baseline

  Evidence: ML inference records + approved version

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: MODEL_DRIFT != MODEL_POISONED

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-002Model behaviorExecutableML

  A served model hash differs from the approved hash

  Evidence: ML inference records + approved hash

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: MODEL_DRIFT != MODEL_POISONED

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-003Model behaviorExecutableML

  Input feature distribution drift crossed the declared…

  Evidence: ML inference records + drift baseline

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: MODEL_DRIFT != MODEL_POISONED

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-004Model behaviorExecutableML

  Prediction variance exceeded baseline plus three standard…

  Evidence: ML inference records + variance baseline

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: MODEL_DRIFT != MODEL_POISONED

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-005Model behaviorExecutableML

  Out-of-distribution score crossed the threshold

  Evidence: ML inference records + OOD scores

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: OOD_DETECTED != ADVERSARIAL_ATTACK

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-006Model behaviorExecutableML

  Model query rate crossed the declared threshold

  Evidence: ML query metrics + threshold

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: HIGH_QUERY_RATE != MODEL_EXTRACTION

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-007Model behaviorExecutableML

  The training data source changed without an approval record

  Evidence: Training provenance records

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: POLICY_CHANGED != POLICY_MANIPULATED · MODEL_DRIFT != MODEL_POISONED

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-008Model behaviorExecutableML

  Output distribution divergence crossed the declared…

  Evidence: ML inference records + output baseline

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: MODEL_DRIFT != MODEL_POISONED

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-009Model behaviorExecutableML

  The same input produced different outputs across repeated…

  Evidence: ML inference records with fingerprints

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: MODEL_DRIFT != MODEL_POISONED

  Remediation: PB-MODEL-DRIFT — see playbooks

• AML-010Model behaviorExecutableML

  A model was accessed by a consumer outside the registered…

  Evidence: ML inference records + consumer registry

  Model drift or tampering changes what the system decides without anyone noticing.

  Never claims: UNREGISTERED_SERVICE != ROGUE_NF

  Remediation: PB-MODEL-DRIFT — see playbooks

• DEL-001Delegated actionsExecutableDELEGATION

  A delegation chain expanded its observed scope

  Evidence: Delegation chain events + declared scopes

  A broken or widened delegation chain lets an action run without its granted authority.

  Never claims: DELEGATION != AUTHORITY_PLANE · CHAIN_SCOPE_CHANGE != PRIVILEGE_ESCALATION

  Remediation: PB-DELEGATION — see playbooks

• DEL-002Delegated actionsExecutableDELEGATION

  A delegation chain head was not authenticated

  Evidence: Delegation chain events

  A broken or widened delegation chain lets an action run without its granted authority.

  Never claims: CHAIN_SCOPE_CHANGE != PRIVILEGE_ESCALATION

  Remediation: PB-DELEGATION — see playbooks

• DEL-003Delegated actionsExecutableDELEGATION

  Delegation chain continuity was broken

  Evidence: Delegation chain events

  A broken or widened delegation chain lets an action run without its granted authority.

  Never claims: DELEGATION != AUTHORITY_PLANE

  Remediation: PB-DELEGATION — see playbooks

• DEL-004Delegated actionsExecutableDELEGATION

  A sub-agent response carried a hidden command pattern

  Evidence: Delegation chain events + response text

  A broken or widened delegation chain lets an action run without its granted authority.

  Never claims: INSTRUCTION_LIKE != ATTACK

  Remediation: PB-DELEGATION — see playbooks

• DEL-005Delegated actionsExecutableDELEGATION

  A cross-agent privilege change was observed

  Evidence: Delegation chain events

  A broken or widened delegation chain lets an action run without its granted authority.

  Never claims: CHAIN_SCOPE_CHANGE != PRIVILEGE_ESCALATION

  Remediation: PB-DELEGATION — see playbooks

• DEL-006Delegated actionsExecutableDELEGATION

  An RFC 8693 act-claim splice was detected in a chain

  Evidence: Delegation chain events + token claims

  A broken or widened delegation chain lets an action run without its granted authority.

  Never claims: CHAIN_SCOPE_CHANGE != PRIVILEGE_ESCALATION

  Remediation: PB-DELEGATION — see playbooks

• DEL-007Delegated actionsExecutableDELEGATION

  An action was taken outside the declared delegation scope

  Evidence: Delegation chain events + declared actions

  A broken or widened delegation chain lets an action run without its granted authority.

  Never claims: DELEGATION != AUTHORITY_PLANE · CHAIN_SCOPE_CHANGE != PRIVILEGE_ESCALATION

  Remediation: PB-DELEGATION — see playbooks

• DEL-008Delegated actionsExecutableDELEGATION

  A delegation justification gap exceeded the declared…

  Evidence: Delegation chain events + justification timing

  A broken or widened delegation chain lets an action run without its granted authority.

  Never claims: CHAIN_SCOPE_CHANGE != PRIVILEGE_ESCALATION

  Remediation: PB-DELEGATION — see playbooks

• ID-001Agent identityExecutableIDENTITY

  An agent identity is unknown to the registry

  Evidence: Identity records + agent registry

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: AGENTIC_IDENTITY != USER_IDENTITY · UNREGISTERED != MALICIOUS

  Remediation: PB-IDENTITY — see playbooks

• ID-002Agent identityExecutableIDENTITY

  An OAuth client id is not mapped to a registered agent

  Evidence: Identity records + client mapping

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: OAUTH_CLIENT_ID != AGENT_IDENTITY

  Remediation: PB-IDENTITY — see playbooks

• ID-003Agent identityExecutableIDENTITY

  A presented SPIFFE id differs from the expected identity

  Evidence: Identity records + SPIFFE expectations

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: AGENTIC_IDENTITY != USER_IDENTITY

  Remediation: PB-IDENTITY — see playbooks

• ID-004Agent identityExecutableIDENTITY

  A delegation chain was not preserved across the hop

  Evidence: Identity records + chain state

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: DELEGATION != AUTHORITY_PLANE

  Remediation: PB-IDENTITY — see playbooks

• ID-005Agent identityExecutableIDENTITY

  A scope reduction was not enforced down-chain

  Evidence: Identity records + scope state

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: CHAIN_SCOPE_CHANGE != PRIVILEGE_ESCALATION

  Remediation: PB-IDENTITY — see playbooks

• ID-006Agent identityExecutableIDENTITY

  An agent attestation is missing or invalid

  Evidence: Identity records + attestation

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: AGENTIC_IDENTITY != USER_IDENTITY

  Remediation: PB-IDENTITY — see playbooks

• ID-007Agent identityExecutableIDENTITY

  An agent profile does not match its execution surface

  Evidence: Identity records + surface

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: AGENTIC_IDENTITY != USER_IDENTITY

  Remediation: PB-IDENTITY — see playbooks

• ID-008Agent identityExecutableIDENTITY

  An agent trust profile is expired

  Evidence: Identity records + trust profile expiry

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: AGENTIC_IDENTITY != USER_IDENTITY

  Remediation: PB-IDENTITY — see playbooks

• ID-009Agent identityExecutableIDENTITY

  An agent lineage chain is broken

  Evidence: Identity records + lineage

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: AGENTIC_IDENTITY != USER_IDENTITY

  Remediation: PB-IDENTITY — see playbooks

• ID-010Agent identityExecutableIDENTITY

  A just-in-time grant was used as a standing privilege

  Evidence: Identity records + grant type

  Unverified agent identity means actions cannot be attributed or trusted.

  Never claims: AGENTIC_IDENTITY != USER_IDENTITY · CHAIN_SCOPE_CHANGE != PRIVILEGE_ESCALATION

  Remediation: PB-IDENTITY — see playbooks

• TOWER-001Cell and tower accessExecutableTOWER

  A handover moved a device to a cell outside the declared…

  Evidence: Handover records + declared cell scope

  Cell and tower access outside the declared footprint can expose devices to the wrong network elements.

  Never claims: HANDOVER != UNAUTHORIZED_ACCESS

• TOWER-002Cell and tower accessExecutableTOWER

  A device handover chain exceeded the declared baseline…

  Evidence: Handover records + chain baseline

  Cell and tower access outside the declared footprint can expose devices to the wrong network elements.

  Never claims: LONG_CHAIN != ATTACK

• TOWER-003Cell and tower accessExecutableTOWER

  The same device appeared on multiple cells inside an…

  Evidence: Handover records + session window

  Cell and tower access outside the declared footprint can expose devices to the wrong network elements.

  Never claims: IMPLAUSIBLE != SPOOFING

• TOWER-004Cell and tower accessExecutableTOWER

  An agent accessed a cell outside its declared scope

  Evidence: Handover records + agent declared scope

  Cell and tower access outside the declared footprint can expose devices to the wrong network elements.

  Never claims: SCOPE_VIOLATION != ATTACK

• TOWER-005Cell and tower accessExecutableTOWER

  A device moved to a cell that is not in the declared…

  Evidence: Handover records + declared topology snapshot

  Cell and tower access outside the declared footprint can expose devices to the wrong network elements.

  Never claims: ROGUE_CELL_CANDIDATE != CONFIRMED

• RAPP-SC-001App supply chainExecutableORAN_WG11

  An application artifact hash differs from the approved…

  Evidence: Onboarding manifest + artifact hash

  A changed or unsigned application artifact can ship code nobody approved.

  Never claims: HASH_MISMATCH != TAMPERING

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• RAPP-SC-002App supply chainExecutableORAN_WG11

  An application artifact is missing a signature or the…

  Evidence: Onboarding pipeline signature check

  A changed or unsigned application artifact can ship code nobody approved.

  Never claims: MISSING_SIGNATURE != MALICIOUS

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• RAPP-SC-003App supply chainExecutableORAN_WG11

  Observed dependencies drifted from the approved set

  Evidence: Package manifest vs approved SBOM

  A changed or unsigned application artifact can ship code nobody approved.

  Never claims: DEPENDENCY_DRIFT != ATTACK

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• RAPP-SC-004App supply chainExecutableORAN_WG11

  An application binary was modified after onboarding

  Evidence: Runtime integrity check

  A changed or unsigned application artifact can ship code nobody approved.

  Never claims: HASH_MISMATCH != TAMPERING

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• RAPP-SC-005App supply chainExecutableORAN_WG11

  An unsigned application came from a third-party registry

  Evidence: Registry metadata + signature state

  A changed or unsigned application artifact can ship code nobody approved.

  Never claims: MISSING_SIGNATURE != MALICIOUS

  Remediation: PB-SUPPLY-CHAIN — see playbooks

• RAPP-EX-001App data leavingExecutableORAN_WG11

  Egress volume exceeded baseline plus the declared threshold

  Evidence: Egress metrics + baseline

  Data leaving through unexpected volume or destinations can become a reportable exposure.

  Never claims: EGRESS_VOLUME != EXFILTRATION

  Remediation: PB-EGRESS — see playbooks

• RAPP-EX-002App data leavingExecutableORAN_WG11

  An egress destination sits outside the approved allowlist

  Evidence: Egress logs + allowlist

  Data leaving through unexpected volume or destinations can become a reportable exposure.

  Never claims: DESTINATION_OUTSIDE != EXFILTRATION

  Remediation: PB-EGRESS — see playbooks

• RAPP-EX-003App data leavingExecutableORAN_WG11

  A data selection was broader than the declared pattern

  Evidence: Query logs + declared selection

  Data leaving through unexpected volume or destinations can become a reportable exposure.

  Never claims: BULK_READ != EXFILTRATION

  Remediation: PB-EGRESS — see playbooks

• RAPP-EX-004App data leavingExecutableORAN_WG11

  Telemetry was read by an application that is not authorized…

  Evidence: Access-control logs

  Data leaving through unexpected volume or destinations can become a reportable exposure.

  Never claims: UNAUTHORIZED_READ != EXFILTRATION

  Remediation: PB-EGRESS — see playbooks

• RAPP-LM-001App-to-app trafficExecutableORAN_WG11

  Traffic flowed between two applications never paired in the…

  Evidence: Service-mesh logs + baseline peers

  Traffic between applications that were never meant to talk can hide movement toward sensitive functions.

  Never claims: MESH_TRAFFIC != LATERAL_MOVEMENT

• RAPP-LM-002App-to-app trafficExecutableORAN_WG11

  The same credential was reused across application boundaries

  Evidence: Identity logs + credential ids

  Traffic between applications that were never meant to talk can hide movement toward sensitive functions.

  Never claims: CREDENTIAL_REUSE != LATERAL_MOVEMENT

• RAPP-LM-003App-to-app trafficExecutableORAN_WG11

  East-west traffic reached a peer outside the expected set

  Evidence: Network flow logs + expected peers

  Traffic between applications that were never meant to talk can hide movement toward sensitive functions.

  Never claims: MESH_TRAFFIC != LATERAL_MOVEMENT

• RAPP-LM-004App-to-app trafficExecutableORAN_WG11

  A privilege escalation was observed inside the service mesh

  Evidence: Runtime authorization logs

  Traffic between applications that were never meant to talk can hide movement toward sensitive functions.

  Never claims: PRIVILEGE_CHANGE != LATERAL_MOVEMENT