CORE v1.0 · MODULE 10
ARGUS7 / DECISION SUPPORT
Strategy
Trasformare finding, rischio, impatto, confidenza e vincoli in azioni prioritarie, alternative e rischio residuo.
INPUTSOURCEMODULE ANALYSISEVIDENCEHUMAN REVIEWOUTPUT
01 / DECISION SUPPORT
Ogni elemento visualizzato deriva dal dataset del caso.
Zoom, pan, filtri, selezione e dettaglio espongono entità, relazioni, Source ID ed Evidence ID. Nessuna rotazione automatica o dato casuale.
IMPACT →LIKELIHOOD ↑RISK CONTEXT / DEMONSTRATION
02 / DEFENSIVE GOVERNANCE
Dalla vulnerabilità alla priorità di remediation.
Una vista tracciabile del contesto CISA BOD 26-04: intelligence, esposizione, sfruttamento noto, impatto tecnico e responsabilità umana.
OFFICIAL DIRECTIVE CONTEXT / DEFENSIVE GOVERNANCE
CISA BOD 26-04 prioritization model
This ARGUS7 view illustrates how evidence can support risk-based remediation decisions. It is not a CISA implementation, a compliance determination, or a live assessment of any organization.
Exposure and known exploitation raise priority; they do not independently establish compromise.
Every proposed action retains an owner, rationale, dependency, due date and residual-risk statement.
Directive context remains linked to the original source and implementation guidance.
03 / MODULE SPECIFICATION
Scopo, responsabilità e confini operativi.
La pagina mantiene nomi, agenti, routing e dipendenze della baseline ARGUS7.
PURPOSE
Trasformare finding, rischio, impatto, confidenza e vincoli in azioni prioritarie, alternative e rischio residuo.
TARGET ARCHITECTUREA
INPUTSINPUTS
- Finding
- Risk e impact
- Confidence breakdown
- Vincoli e dipendenze
B
PROCESSPROCESS
- Hypothesis generation
- Prioritization
- Resource allocation
- Dependency mapping
- Residual-risk analysis
C
ACTIVATED AGENTSACTIVATED AGENTS
- Strategy Orchestrator
- Hypothesis Generation
- Investigation Plan
- Resource Allocation
D
TOOLS / SOURCESTOOLS / SOURCES
- Layer 9 / MCP via n8n
- Layer 8 Memory / RAG
- Vector Search
- Feedback moduli
E
VALIDATION / EVIDENCEVALIDATION / EVIDENCE
- Success e stop condition
- Alternative
- Impatto / costo / rischio
- HITL su escalation
F
OUTPUTOUTPUT
- Recommended actions
- Priority queue
- Decision tree
- Residual-risk statement
CONNECTED MODULES / COMPONENTS
InvestigationsCyberIntelFraudGovernance
04 / RISK ↔ CONTROL
Attività avversaria e risposta difensiva, senza contenuti operativi abusabili.
TTP pubblicamente documentati vengono descritti per detection, triage e mitigazione. Exploit, payload e procedure offensive eseguibili non sono pubblicati.
- Known exploitation
- Asset exposure
- Technical impact
- Constraints
- Priority
- Owner
- Dependency
- Residual risk
05 / CONNECTED CASES
Il modulo non opera in isolamento.
Gli stessi case study attraversano più moduli, con un unico modello dati e la stessa catena di evidenza.
CASE-CY-2023-001INTERACTIVE DEMONSTRATION
REAL PUBLIC CYBERSECURITY CASE
MOVEit Transfer / CL0P
5 EVIDENCE · 4 RELATIONSHIPSCyber · Intel · Investigations · Graph · Forensics · Research · StrategyCASE-TI-2024-002INTERACTIVE DEMONSTRATION
REAL PUBLIC THREAT INTELLIGENCE CASE
Volt Typhoon
5 EVIDENCE · 5 RELATIONSHIPSIntel · Cyber · Profiler · Graph · Investigations · Research · StrategyCASE-SC-2024-003INTERACTIVE DEMONSTRATION
REAL SOFTWARE SUPPLY-CHAIN CASE
XZ Utils / CVE-2024-3094
5 EVIDENCE · 4 RELATIONSHIPSResearch · Cyber · Forensics · Intel · Graph · Investigations · StrategyCASE-FR-2026-005INTERACTIVE DEMONSTRATION
SYNTHETIC INVESTIGATION BASED ON REAL FBI-DOCUMENTED PATTERNS