O
onixus SEC_LAB
APEX Platform · 8 Contract-Enforced Components · Open Source
onixus avatar

Composable security engineering with
explicit ownership & versioned boundaries

APEX connects eight focused systems without collapsing them into one monolith: each service owns its domain, the Gateway stays an integration plane, APIs and events are versioned, and the architecture contract is enforced in CI. EvaCal, Metis and R-TrustTunnel remain useful standalone tools for colleagues outside the platform boundary.

APEX Architecture Canonical Participants Engineering Projects
$ git clone https://github.com/onixus/Shapoclyack.git
Корпоративные стандарты & Регламенты

База знаний (Enterprise Wiki) & Ролевые сценарии ИБ

Полный свод операционных регламентов, ролевых руководств и дорожной карты внедрения платформы Shapoclyack на русском языке.

⚡ KNOWLEDGE BASE REPOSITORY & WIKI

Shapoclyack Enterprise Knowledge Base & Operational Framework

Открыть GitHub Wiki ↗ Исходники docs/wiki/ ↗
🛠️
ОПЕРАЦИОННАЯ ДЕЯТЕЛЬНОСТЬ

Инженер ИБ

Повседневная работа с уязвимостями, углубленный триаж, валидация исправления и устранение слепого шума:

  • Триаж находок с фиксацией доказательной базы (proof).
  • Инструментальная ре-верификация: закрытие только по повторному скану (machine_verified = true).
  • Patch Gaps: готовые консольные команды обновления дистрибутивов (Ubuntu USN / Debian Security).
  • Фильтрация невоспроизводимых CVE и подавление FP.
Сценарии инженера ИБ →
🏛️
СИСТЕМНАЯ АРХИТЕКТУРА

Архитектор ИБ / Enterprise

Картографирование ландшафта, контроль сегментации, интеграции и соответствие регуляторным нормам:

  • Инвентаризация периметра (EASM/CAASM), выявление Shadow IT.
  • Топология remote agents через NATS JetStream mTLS без входящих портов в сегментах.
  • Интеграция с CMDB, Active Directory, CI/CD и SIEM/SOAR.
  • Оценка соответствия: PCI DSS 4.0, CIS Controls v8, ISO 27001.
Сценарии архитектора ИБ →
📊
СТРАТЕГИЧЕСКОЕ УПРАВЛЕНИЕ

CISO / Руководство ИБ

Управление совокупным риском компании, соответствие стандартам и объективные метрики зрелости:

  • Дашборд Estate Risk по NIST SP 800-30 Rev. 1: двухосевой скоринг (вероятность vs ущерб).
  • Контроль эксплойтов в дикой природе (CISA KEV) и EPSS.
  • Контроль соблюдения SLA ремедиации и медианного MTTR.
  • Метрики Adoption и Noise: контроль качества работы команды.
Сценарии CISO / Руководства →
🔄 VM Lifecycle Регламент

Машина состояний от открытия дефекта до машинной перепроверки: OPEN ➔ ASSIGNED ➔ FIXING ➔ VERIFYING ➔ CLOSED. Запрет формальных ручных закрытий без доказательств.

Регламент процессов ИБ →
🚨 Экстренное реагирование (0-Day / KEV)

Регламент немедленной локализации угроз с активными эксплойтами в дикой природе. Экстренный SLA: 24 часа для критических систем и внешнего периметра.

Регламент 0-Day / KEV →
📅 Дорожная карта внедрения (12 недель)

4 фазы внедрения платформы: Пилот ➔ Агенты и сегментация ➔ Интеграция с IT и CI/CD ➔ Промышленная эксплуатация с контролем KPI и матрицей RACI.

План внедрения и RACI →
APEX Architecture Contract v1

One platform, explicit owners

APEX is an integration architecture, not a shared-database monolith. The Gateway connects systems, while each owning service keeps authoritative state and safety-critical authorization.

Normative · v1.0

Architecture rules enforced in repositories

Versioned APIs/events, canonical resource references, idempotent async consumers, W3C Trace Context, ClickHouse as analytics projection only, and signed/provenanced production promotion. The normative contract and participant registry are maintained in the private platform repository.

View Participants Contract Summary
Canonical Participants

APEX Platform Components

Eight independently owned systems with a shared architecture contract. Every component shown here is currently marked enforced in the canonical platform registry.

APEX v1 · enforced FastAPI • Integration Plane Private repo
Integration plane

APEX Gateway

Unified API gateway/BFF implementing the APEX integration plane and versioned cross-system boundaries.

  • Canonical APEX Architecture Contract v1
  • Versioned HTTP/event boundaries instead of private database coupling
  • Owning services keep safety-critical authorization and domain state
  • W3C Trace Context and canonical resource references across boundaries
#APEX#FastAPI#Integration#Contracts
Подробнее / Overview → Private repository
APEX v1 · enforced Python • EASM & RBVM
EASM / RBVM

Shapoclyack

Asset-centric EASM, CAASM and risk-based vulnerability management with evidence-backed remediation.

  • Asset-centric identity across changing network addresses
  • Risk model aligned to NIST SP 800-30 concepts
  • Mechanical remediation re-verification
  • Enterprise Wiki with operational roles, SLA and implementation guides
#Python#EASM#CAASM#RBVM#NIST
Подробнее / Overview → GitHub Repo ↗ Wiki ↗
APEX v1 · enforced Rust • Endpoint Agent
Endpoint inventory

Lariska

Cross-platform endpoint inventory and telemetry agent for the APEX security platform.

  • Cross-platform inventory and Shadow IT signals
  • Local resilient spool and compressed delivery
  • Signed service identity boundary
  • Versioned enrollment, inventory and heartbeat APIs
#Rust#Endpoint#Inventory#Telemetry
Подробнее / Overview → GitHub Repo ↗
APEX v1 · enforced Rust • Kubernetes/eBPF
Kubernetes enforcement

FERRUM

Admission and runtime enforcement plane with signed policy bundles and eBPF datapath.

  • Admission and runtime policy enforcement
  • Signed bundles with last-known-good behavior
  • eBPF runtime datapath
  • Strict product boundary gates and canonical APEX URNs
#Rust#Kubernetes#eBPF#Policy
Подробнее / Overview → GitHub Repo ↗
APEX v1 · enforced Rust • Secure Web Gateway
Secure Web Gateway

BSDM-Proxy

High-performance HTTP/HTTPS proxy and SWG with explicit policy and agent boundaries.

  • HTTP/HTTPS proxy and selective TLS inspection
  • DNS sinkhole and policy enforcement
  • Versioned /api/v1/agent boundary
  • Asynchronous analytics without making ClickHouse transactional state
#Rust#SWG#Proxy#DNS#Policy
Подробнее / Overview → GitHub Repo ↗
APEX v1 · enforced Rust • Network Scanner Private repo
Network scanner

Pulse

Fast network scanning engine with a versioned APEX scan API and scan-report event boundary.

  • Async network and service scanning
  • Versioned /api/v1 scan boundary
  • APEX scan report event adapter
  • CI-enforced local contract manifest
#Rust#Scanner#Network#TLS
Подробнее / Overview → Private repository
APEX v1 · enforced Python • Risk & Causal Analysis Private repo
World-model risk

Oko-Ra

World-model and causal-risk service for scenarios, threat relationships and operational briefings.

  • Threat and scenario graph analysis
  • Causal and cascading-risk projections
  • Versioned agent workflow/result APIs
  • Service-native JWT and tenant boundary
#Python#Risk#Causal#FastAPI
Подробнее / Overview → Private repository
APEX v1 · enforced Rust • BAS & Red Team
Synthetic BAS

ASMODEUS

Synthetic adversary-emulation and resilience validation with explicit safety boundaries.

  • Synthetic BAS and adversary-emulation workflows
  • Signed APEX v1 identity verification
  • Explicit blast-radius and safety constraints
  • Blue-team validation and resilience metrics
#Rust#BAS#Red Team#Safety
Подробнее / Overview → GitHub Repo ↗
Standalone Utilities

Bonus tools for colleagues

EvaCal, Metis and R-TrustTunnel are useful independent tools, but they are deliberately outside the APEX platform and do not participate in the canonical APEX contract registry.

Standalone bonus tool TypeScript • ГОСТ 34
Standalone colleague tool

EvaCal

Standalone presale estimation, project workflow, resource planning and ГОСТ 34 documentation workspace.

  • Role-based estimation, margins and presale approval flow
  • ГОСТ 34 document generation with traceability and review gates
  • Project lifecycle board, actual hours and schedule deviation tracking
  • Portfolio capacity planning and delivery analytics
#TypeScript#ГОСТ-34#Presale#Docs
Подробнее / Overview → GitHub Repo ↗
Standalone bonus tool Go • Portfolio Governance
Standalone colleague tool

Metis

Standalone portfolio-governance workspace for products, priorities, roadmaps, commitments and economics.

  • Portfolio graph, demand signals and prioritization
  • Roadmaps, delivery projections and commitments
  • SSDLC/certification evidence and decision history
  • Economics, P&L scenarios and win/loss analysis
#Go#Portfolio#Roadmap#Governance
Подробнее / Overview → GitHub Repo ↗
Standalone bonus tool Rust • VPN Client • Preview
Standalone VPN client

R-TrustTunnel

Нативный VPN-клиент на Rust для TrustTunnel, Hysteria 2 и AmneziaWG 3. Проект в стадии development preview.

  • TrustTunnel по HTTP/2 и HTTP/3, Hysteria 2 и AmneziaWG 3
  • Нативный desktop UI, WebView-интерфейс и Android VpnService
  • Импорт профилей, зашифрованное хранилище и синхронизация с порталом
  • Диагностика соединения, восстановление и защита fail-closed
#Rust#VPN#TrustTunnel#Hysteria-2#AmneziaWG-3
Подробнее / Overview → GitHub Repo ↗
Interactive Console

Интерактивный терминал

Быстрый доступ к описанию систем, манифестам, структуре репозиториев и разделам Wiki прямо из веб-консоли.

onixus@sec-lab: ~ (zsh)
onixus@apex:~$