M17 · Cyber Diagnostics & IR

Checks the security of the system, analyses logs and helps manage incidents.

Benefits: Local protection that is always on, and proposals that never act without you.

Example of use: Analyse the D-COS logs and get the security posture with the reasons behind it.

Key capabilities

• Security posture with honest states
• Log analysis and integrity comparison
• Incident assessment and response proposals
• Threat intelligence and indicator correlation (licensed)

Cyber Diagnostics & Incident Response. Level A, always active and not licensable: local defence (sicurezza_locale, cyber_* components) and contract m17_diagnostica 1.1.0 (read-only analysis of D-COS logs with SHA-256 before/after, security posture taxonomy where missing data is never SECURE, integrity comparison, incident assessment, response proposals always NOT_EXECUTED). Level B, licence cti: m17_cti (sources, IoC import, motivated correlation) and the add-on dcos_cti. Incidents are mirrored to M26 and metrics to M31.

Prerequisites

Basic defence: none. Advanced CTI: licence cti.

Declared limits

Only supplied data and local feeds are used; no verified remote CTI source; no dedicated dashboard yet.

Planned (roadmap)

• Verified remote CTI sources
• Dedicated Cyber Diagnostics dashboard

Interconnections

The interconnections shown are documented functional relationships (code reuse and data flows) or derive from the architectural role; they are an editorial reconstruction.