CORE DEFENSE
VIEW ON GITHUB ↗
SYS.ID // CORE-DEFENSE-RUNTIME

Pre-breach defense.
Continuous inspection. Zero commit.

Connects directly to Palo Alto Networks firewalls over standard read-only XML API (port 443). Continuously audits 19 posture playbooks and validates hardware packet containment before adversaries test your rules.

EXPLORE REPOSITORY ON GITHUB ↗
PAN-OS 10.x / 11.x / 12.x
TELEMETRY MONITOR // RUNTIME SCOPE
PLATFORM ARCHITECTURE
TARGET FLEET PA-Series · VM-Series · Panorama
API PRIVILEGE 100% Read-Only (0% Commit)
CLI ADAPTER pan-os-python
DATA SANITIZATION Local IP Masking
DEPLOYMENT Self-Hosted Docker
01 / RECON & BAS OPERATOR-IN-THE-LOOP
NEO-COPILOT
On-demand natural language diagnostics and pre-breach attack path simulation. Translates operator queries into read-only PAN-OS XML operational commands.
▶ Natural Language XML Bridge: Ad-hoc firewall queries via pan-os-python over read-only HTTPS.
▶ 85 Operational Diagnostics: Live queries for routing FIB, active session filters, and security rule matches.
▶ Attack Range Simulation: Validates hardware packet containment before adversaries test your rulebase.
02 / POSTURE & HUNTING AUTONOMOUS DAEMON
NEO-AUTOPILOT
Ambient perimeter auditing engine. Dispatches 19 automated playbooks across continuous (5m), periodic (30m), daily, and weekly schedules.
▶ 19 Inspection Playbooks: Audits HA split-brain, rule shadowing, uninspected permits, and lateral movement.
▶ Automated Anomaly Baselines: Learns normal firewall behavior over time to detect anomalies without manual threshold tuning.
▶ Real-Time Finding Cards: Streams authenticated evidence findings (FT-01–OR-03) via SSE.