{ "schema_version": "2.0", "published": "2026-10-16", "description": "Canonical public capability registry for Araghatta. This is the single source of truth for what is available today: every capability listed here is generally available. Every marketing page must agree with the state and summary recorded here. The endpoint sensor observes and warns by default; graduated endpoint enforcement (warn, then block or quarantine) is built into every sensor and switches on per organization as an opt-in, operator-authorized, audited mode, with the Enforcement licence.", "states": { "ga": "Generally available" }, "capabilities": [ { "key": "endpoint_discovery", "name": "Endpoint AI discovery", "state": "ga", "label": "GA", "summary": "Eleven signal classes of AI on the host — AI CLIs and agents, provider keys, MCP servers and tool scope, IDE assistants, skills, SDKs, installed apps, browser extensions, egress to AI endpoints, vibe-coded repositories and non-human identities.", "platforms": [ "Windows 10", "Windows 11", "macOS", "Linux" ], "last_verified": "2026-08-23" }, { "key": "ai_runtime_stack", "name": "AI runtime-stack discovery", "state": "ga", "label": "GA", "group": null, "summary": "Discovers the AI runtime stack between the application and the model: RAG applications, vector databases, ingestion pipelines, agent memory, datasets, trace stores, model endpoints, embedding providers, orchestrators, agent tools and the credentials they hold, tool servers, skills, delegated identities and AI supply-chain artifacts. Known products and in-house components are both found. Every finding carries evidence, a plain-language explanation and an expected-annual-loss contribution.", "platforms": [ "Windows", "macOS", "Linux" ], "last_verified": "2026-09-15" }, { "key": "ai_runtime_stack_preview", "name": "AI runtime-stack — extended coverage", "state": "ga", "label": "GA", "group": null, "summary": "Six further categories — AI gateways & proxies, custom & low-code assistants, remote A2A agents, training/dev environments, ephemeral workloads and SaaS-embedded AI — discovered on-host alongside the core runtime stack.", "platforms": [], "last_verified": "2026-09-07" }, { "key": "ai_stack_quantification", "name": "AI-stack risk quantification ($)", "state": "ga", "label": "GA", "group": null, "summary": "Expresses the discovered AI stack as an expected-annual-loss figure with transparent, tenant-overridable assumptions and a reported range: a board-facing number covering RAG, vector and agent-tool exposure, not only cloud attack paths. An order-of-magnitude estimate for prioritization, not an actuarial calculation.", "platforms": [], "last_verified": "2026-09-03" }, { "key": "windows_endpoint", "name": "Windows endpoint sensor", "state": "ga", "label": "GA", "summary": "Windows client discovery across x64, x86 and ARM64 builds. Observe by default; block and quarantine are built in and switch on per organization (opt-in, audited), with the Windows Firewall's own settings restored exactly afterwards. Reads per-user installs, Microsoft Store apps and each person's own settings. Roadmap (planned, not available today): validated coverage of Windows 10 and 11 Enterprise, Pro and LTSC, with an MSI package and Group Policy deployment.", "platforms": [ "Windows client", "x64", "x86", "ARM64" ], "last_verified": "2026-10-14" }, { "key": "windows_server", "name": "Windows Server sensor", "state": "ga", "label": "GA", "summary": "Windows Server runs the same discovery collectors as the client sensor. Built for x64, x86 and ARM64; not yet run on production hardware. Roadmap (planned, not available today): validated coverage of Windows Server 2016 to 2025 including Server Core, domain controllers, RDS and failover clusters.", "platforms": [ "Windows Server" ], "last_verified": "2026-09-15" }, { "key": "mobile_discovery", "name": "Mobile AI-app discovery", "state": "ga", "label": "GA", "summary": "AI apps on managed iOS/iPadOS/Android devices, discovered from your MDM/UEM application inventory by account type (managed vs personal) and management mode (supervised / BYOD). This is an MDM/UEM integration, not the endpoint sensor — it imports from Intune, Jamf and Workspace ONE and reads the app and device inventory the MDM already holds. Coverage is bounded by what the MDM reports (no per-app egress or on-device content); it does not run on the device or inspect on-device network traffic.", "platforms": [ "iOS", "iPadOS", "Android" ], "last_verified": "2026-09-15" }, { "key": "linux", "name": "Linux endpoint sensor", "state": "ga", "label": "GA", "summary": "Enterprise Linux discovery with live tracing of programs and connections. Observe by default; enforcement is an opt-in, audited mode. Tested end to end in containers on Ubuntu, Debian, RHEL and its clones, Amazon Linux, SUSE, Fedora and Alpine, on x86-64 and arm64, and in a virtual machine on Ubuntu. Block, quarantine, the quarantine allowlist and sub-domain blocking were also run end to end in an Ubuntu virtual machine. The packaged service unit caps the sensor's CPU and memory. Roadmap (planned, not available today): validation on virtual machines and bare metal for each distribution, including the packaged service and SELinux.", "platforms": [ "Ubuntu", "Debian", "RHEL and clones", "Amazon Linux", "SUSE", "x86-64 and arm64" ], "last_verified": "2026-10-14" }, { "key": "macos", "name": "macOS endpoint sensor", "state": "ga", "label": "GA", "summary": "macOS discovery on Intel and Apple silicon. Observe by default; block and quarantine are built in and switch on per organization (opt-in, audited), with the macOS firewall checked after every change. Reports the installed version of apps and command-line tools so an upgrade is visible. Roadmap (planned, not available today): event-assisted real-time tracing.", "platforms": [ "macOS Intel", "macOS Apple silicon" ], "last_verified": "2026-10-14" }, { "key": "containers", "name": "Container & Kubernetes coverage", "state": "ga", "label": "GA", "summary": "The sensor ships as a container image and a Kubernetes node agent, one per node, observing by default. It enrolls, reports and attests like any other endpoint. A privileged variant adds live tracing. The sensor and the agentless Kubernetes connector observe only: there is no admission controller. Virtual desktops and multi-user desktops are not covered. Roadmap (planned, not available today): a Kubernetes admission-controller and policy integration.", "platforms": [ "Docker", "Kubernetes", "Linux (amd64/arm64)" ], "last_verified": "2026-09-15" }, { "key": "aws", "name": "AWS organization and AI discovery", "state": "ga", "label": "GA", "summary": "Least-privilege, read-only AWS organization connector for AI service, identity and control-plane discovery.", "platforms": [ "AWS Organizations", "Bedrock", "SageMaker", "EKS", "Lambda" ], "last_verified": "2026-08-23" }, { "key": "azure", "name": "Microsoft Azure cloud and AI discovery", "state": "ga", "label": "GA", "summary": "Microsoft Azure and Entra AI discovery — Azure OpenAI, AI Foundry, AKS.", "platforms": [ "Azure", "Entra", "Azure OpenAI", "AI Foundry", "AKS" ], "last_verified": "2026-09-07" }, { "key": "gcp", "name": "Google Cloud and AI discovery", "state": "ga", "label": "GA", "summary": "Google Cloud and hybrid cloud↔on-prem AI attack-path discovery (read-only service account) — Vertex AI, Gemini, GKE, Cloud Run.", "platforms": [ "Google Cloud", "Vertex AI", "Gemini", "GKE", "Cloud Run" ], "last_verified": "2026-09-07" }, { "key": "cloud_server_cspm", "name": "Sensor-led cloud server CSPM", "state": "ga", "label": "GA", "summary": "Sensor-led cloud security posture management on AWS, Google Cloud and Azure (EC2, Compute Engine, Azure VMs, Windows Server, Linux), with hybrid cloud↔on-prem paths. Roadmap (planned, not available today): sensor metadata on Compute Engine and Azure VMs, and deeper effective-access evaluation (conditions, Deny, SCPs, resource policies).", "platforms": [ "AWS EC2", "Google Compute Engine", "Azure VMs", "Windows Server", "Linux" ], "last_verified": "2026-08-23" }, { "key": "agent_attack_paths", "name": "AI-agent cloud attack-path analysis", "state": "ga", "label": "GA", "summary": "Attack-path analysis across connected cloud accounts: AWS, plus Azure and Google Cloud through their connectors. Paths are chained in both directions: an AI misconfiguration on an endpoint that exposes a cloud credential is followed into the cloud account it grants, and a cloud network path that routes into a private range is followed back onto the on-prem network it reaches. Every link is evidenced, never asserted. Roadmap (planned, not available today): Azure network-rule paths, and corroboration from cloud-provider findings.", "platforms": [ "AWS IAM and S3", "Azure", "Google Cloud", "on-prem endpoints via the sensor" ], "last_verified": "2026-08-31" }, { "key": "scoring", "name": "Explainable, tunable risk scoring", "state": "ga", "label": "GA", "summary": "Deterministic, explainable and tunable risk scoring — every score is auditable to its evidence, and weight changes can be simulated before you apply them.", "platforms": [ "Risk scoring", "Threat scoring" ], "last_verified": "2026-08-23" }, { "key": "ai_reasoning", "name": "Advisory AI reasoning", "state": "ga", "label": "GA", "summary": "Advisory AI reasoning grounded in MITRE ATLAS and ATT&CK. Advisory only — it cannot change the deterministic score or fabricate techniques.", "platforms": [ "MITRE ATLAS", "MITRE ATT&CK" ], "last_verified": "2026-08-23" }, { "key": "approved_ai_policy", "name": "Approved-AI policy", "state": "ga", "label": "GA", "summary": "Approved-AI policy governance — flag and alert on unsanctioned AI fleet-wide. Flag-and-alert by default; real in-line block/quarantine on the host is available as an opt-in mode that is built into every sensor and switched on per organization.", "platforms": [ "Allow-list", "Deny-list", "Alerting" ], "last_verified": "2026-10-14" }, { "key": "content_dlp", "name": "Content DLP policy engine", "state": "ga", "label": "GA", "summary": "Server-side content-DLP policy engine: monitor, warn, redact or block decisions per data class through an inspection service you deploy and control. Inline checks of what a person submits to ChatGPT, Claude or Gemini are made by the managed Sargha browser extension on user workstations, not on servers: it sends the text over TLS to your own collector for a block, redact or allow decision. The text is evaluated in memory and is not stored, and it never goes to the reasoning model; only the decision, the destination site and the kinds of data found are recorded. It works in Chrome and Edge. It is opt-in and separate from the sensor: the sensor on the machine only hands the extension its settings, and never reads prompts.", "platforms": [ "Block", "Redact", "Warn", "Allow", "Monitor-first" ], "last_verified": "2026-10-14" }, { "key": "policy_governance", "name": "Policy governance", "state": "ga", "label": "GA", "summary": "Per-tenant policy governance — approved-AI policy, content-DLP policy and allow-with-acknowledgement, with an audit log of every change. Policy can be server-scoped. Per-host quarantine approval can require a ticket or change reference, a time limit and a second administrator. The audit log is hash-chained with signed checkpoints. Export destinations can be limited to a per-tenant allow-list, and a legal hold suspends deletion. Roadmap (planned, not available today): inline cloud-side policy enforcement at the cloud control plane.", "platforms": [ "Policy engine", "Audit trail" ], "last_verified": "2026-10-12" }, { "key": "privacy_controls", "name": "Privacy and data-minimization controls", "state": "ga", "label": "GA", "summary": "Privacy and data-minimization controls — the sensor never reads prompts, chats or file contents; secret values are fingerprinted at the source and never leave the device. An optional per-tenant setting, off by default, stores keyed one-way tokens in place of machine names, account names and cloud resource names, and can stop storing IP addresses and cloud resource tags. A token is stable within a tenant, so inventory and history still line up; it does not apply to mobile data.", "platforms": [ "Data minimization", "Redaction", "Erasure" ], "last_verified": "2026-10-16" }, { "key": "asset_ownership", "name": "Asset ownership", "state": "ga", "label": "GA", "summary": "Asset ownership assignment — manual and CSV import, plus auto-sync from Okta, Microsoft Entra ID and ServiceNow. Roadmap (planned, not available today): more sync sources (Intune, Jamf, CMDB, CrowdStrike, Defender).", "platforms": [ "Manual", "CSV import" ], "last_verified": "2026-08-23" }, { "key": "remediation", "name": "Remediation workflow", "state": "ga", "label": "GA", "summary": "Risk lifecycle and remediation workflow — assign, track, reopen and evidence remediation with SLA policy.", "platforms": [ "Risk lifecycle", "SLA policy" ], "last_verified": "2026-08-23" }, { "key": "api", "name": "Versioned REST API", "state": "ga", "label": "GA", "summary": "Versioned REST API with scoped service-account keys over risks, findings, sensors and cloud posture.", "platforms": [ "REST", "Service-account keys", "Webhooks" ], "last_verified": "2026-08-23" }, { "key": "fleet_ops", "name": "Sensor fleet operations", "state": "ga", "label": "GA", "summary": "Sensor fleet operations — enrollment, versioned pinned updates with optional named update rings (canary, pilot and broad, each with its own wait after a release is promoted), binary attestation, per-device pause and server-side revoke. While the collector is unreachable the sensor keeps its enforcement and real-time events on disk, up to a fixed size, and sends them in order when it returns; one command writes a support bundle with keys, tokens and home-folder names removed. Proxy settings include a PAC file, the operating system’s proxy settings (the macOS network settings and the Windows machine-wide proxy) and WPAD discovery, which is off by default; tested with simulated proxies, PAC files and system settings, not yet through a customer’s proxy environment. A built-in check lists what the sensor needs permission to read or change on each system and reports what is missing on a machine; the same list is shown in the console before deployment. Roadmap (planned, not available today): live validation of the deployment kits for Kandji, Ansible and Configuration Manager.", "platforms": [ "Enrollment", "Pinned updates", "Attestation" ], "last_verified": "2026-10-15" }, { "key": "siem", "name": "SIEM and OCSF export", "state": "ga", "label": "GA", "summary": "Outbound SIEM and SOAR export: Splunk and QRadar receive findings directly, Microsoft Sentinel, Elastic and Google Chronicle receive a signed message, and an open format can be sent to any collector. Roadmap (planned, not available today): native Sentinel (Logs Ingestion), QRadar LEEF and Elastic ECS outputs, built and in validation against live systems, a Google Chronicle output and an Amazon Security Lake writer.", "platforms": [ "Splunk", "QRadar", "Open format", "Signed webhook" ], "last_verified": "2026-10-12" }, { "key": "slack_jira", "name": "Slack and Jira integrations", "state": "ga", "label": "GA", "summary": "Slack ChatOps alerts and Jira ticketing (per-risk tickets and per-sensor epics).", "platforms": [ "Slack", "Jira" ], "last_verified": "2026-08-23" }, { "key": "edr_itsm_connectors", "name": "EDR and ITSM read-back connectors", "state": "ga", "label": "GA", "summary": "Read-back connectors: CrowdStrike and Defender coverage reconciliation against your fleet (blind spots and unmanaged devices), and ServiceNow incident read-back. Vendor certification is not claimed, and there is no packaged ServiceNow app. Outbound export and Slack and Jira work alongside. Roadmap (planned, not available today): vendor-certified two-way integrations and a packaged ServiceNow connector.", "platforms": [ "EDR", "ITSM" ], "last_verified": "2026-09-15" }, { "key": "vendor_transparency", "name": "Vendor cross-tenant access transparency", "state": "ga", "label": "GA", "summary": "Customer-approved, time-bound vendor cross-tenant access with full transparency and an audit record.", "platforms": [ "Access transparency", "Audit" ], "last_verified": "2026-08-23" }, { "key": "sso", "name": "OIDC single sign-on", "state": "ga", "label": "GA", "summary": "OIDC single sign-on — Okta, Entra ID, Google Workspace, Auth0 and standards-compatible OIDC providers. SAML 2.0 is available alongside it. Sign-in can be limited to the email domains you list. Temporary Admin access: a person requests it with a reason, a different Owner approves it, and it ends by itself.", "platforms": [ "Okta", "Entra ID", "Google Workspace", "Auth0" ], "last_verified": "2026-10-12" }, { "key": "saml", "name": "SAML single sign-on", "state": "ga", "label": "GA", "summary": "SAML 2.0 single sign-on alongside OIDC. The SP verifies the IdP's signed assertion for real (XML-DSig RSA-SHA256, exclusive-C14N, your X.509 cert), enforces audience / validity / recipient, is hardened against XML-Signature-Wrapping, and JIT-provisions users with group-to-role mapping. Per-tenant metadata + ACS endpoints; works with Okta, Entra ID, ADFS and Ping.", "platforms": [ "SAML 2.0" ], "last_verified": "2026-09-04" }, { "key": "scim", "name": "SCIM 2.0 lifecycle management", "state": "ga", "label": "GA", "summary": "SCIM 2.0 provisioning and deprovisioning: automated user lifecycle and group-to-role mapping. Deactivating a user in your identity provider disables the account and revokes that user's enrolled sensors. Roadmap (planned, not available today): offboarding that also triggers AI-access review and revocation.", "platforms": [ "Okta", "Entra ID", "Google Workspace" ], "last_verified": "2026-08-23" }, { "key": "response", "name": "Response controls", "state": "ga", "label": "GA", "summary": "Response: detect + alert + your Slack/Jira/SIEM integrations + per-device pause and server-side revoke — and real endpoint block (drop the specific egress, terminate the process) / quarantine as an opt-in mode built into every sensor. All operator-authorized and audited. Block and quarantine are generally available on Windows, macOS and Linux. Roadmap (planned, not available today): connector-driven revoke, block and quarantine, and coordinated response across endpoint, cloud and identity.", "platforms": [ "Alert", "Pause", "Server-side revoke" ], "last_verified": "2026-10-14" }, { "key": "endpoint_enforcement", "name": "In-line endpoint enforcement (block / quarantine)", "state": "ga", "label": "GA", "summary": "Graduated, criticality-gated endpoint enforcement: warn (alert), then block or quarantine. Built into every sensor and switched on for an organization only with the Enforcement licence and its opt-in; a local switch on the machine always wins. Every action is operator-authorized and audited. After applying, the sensor checks the machine (is the block or isolation really in force, is the collector still reachable) and reports the result to the console; a quarantine that would cut the machine off from its collector is undone at once, and everything is put back exactly when enforcement is switched off. Generally available on Windows, macOS and Linux. Servers, production and unknown assets are never auto-isolated. A blocked site is blocked together with everything under it (for example the chat and api names of the same domain) on Windows, macOS and Linux; the name is also written to the machine's hosts file, and blocking the addresses behind a name is a separate organization option, because those addresses can be shared with other sites. Where the managed browser extension is installed, it also refuses blocked sites inside the browser, even when the browser uses encrypted DNS. A quarantine also cuts connections that already existed, and can keep addresses you choose reachable for your responders (Windows, macOS and Linux). On a machine that cannot reach the console, an administrator can issue a time-limited code for that one machine, and a person at the machine enters it to lift enforcement until the code expires (macOS today; the code works for that machine only and stops working if the machine is enrolled again). The sensor keeps the last policy it received on the machine, so protection continues through a network outage or a restart. While blocking is on, macOS and Windows machines keep one socket bound to the machine's own loopback address to block sub-domains; nothing outside the machine can reach it, and Linux opens none. Roadmap (planned, not available today): kernel-level containment.", "platforms": [ "Warn", "Block (Windows, macOS, Linux)", "Quarantine (Windows, macOS, Linux)", "Blocked sites and sub-domains (Windows, macOS, Linux)", "Browser block (with the extension)", "Quarantine allowlist (Windows, macOS, Linux)", "Offline release code (macOS)" ], "last_verified": "2026-10-14" }, { "key": "ownership_autosync", "name": "Ownership auto-sync", "state": "ga", "label": "GA", "summary": "Read-only inbound connectors (Okta, Microsoft Entra, ServiceNow) pull your people/asset directory and set each device owner + team automatically, idempotently, with a dry-run. Manual + CSV too. Roadmap (planned, not available today): Intune, Jamf and CMDB sources.", "platforms": [ "Okta", "Entra ID", "ServiceNow" ], "last_verified": "2026-09-15" }, { "key": "compliance", "name": "Compliance mapping and signed evidence", "state": "ga", "label": "GA", "summary": "Compliance control mapping and signed, immutable evidence reports — NIST AI RMF, ISO 42001, OWASP LLM and EU AI Act. This is control mapping and evidence, not a certification of your organization. Each finding in the product's reports carries OWASP and CWE references. Roadmap (planned, not available today): automatic EU AI Act mapping for Art. 6, 9, 11, 12, 26, 50, 55 and 72. Today Art. 4, 10, 14 and 15 are mapped automatically and the rest are referenced by hand.", "platforms": [ "NIST AI RMF", "ISO 42001", "OWASP LLM", "EU AI Act" ], "last_verified": "2026-10-12" }, { "key": "accessibility", "name": "Accessibility", "state": "ga", "label": "GA", "summary": "The console is built to align with WCAG 2.2 AA (self-assessed, not independently audited).", "platforms": [ "WCAG 2.2 AA" ], "last_verified": "2026-08-23" }, { "key": "private_deployment", "name": "Dedicated and customer-cloud deployment", "state": "ga", "label": "GA", "summary": "Every customer gets a dedicated tenant on the shared platform, isolated from other customers. By arrangement: a dedicated database, a dedicated managed tenant, or a customer-cloud deployment. Managed hosting is in one US region; private connectivity and customer-managed keys are scoped per contract. Roadmap (planned, not available today): regional data planes and region choice (including EU-region managed tenants), customer-managed keys and private connectivity on managed tenants, a packaged dedicated tenant, and an air-gapped package.", "platforms": [ "Dedicated tenant", "Dedicated database (by arrangement)", "Customer VPC (by arrangement)" ], "last_verified": "2026-08-23" }, { "key": "scale", "name": "Large-fleet design", "state": "ga", "label": "GA", "summary": "Designed for large fleets: tiered sensor cadence, delta reporting and staged rollouts keep per-endpoint load low. Sizing guidance is available on request; a fleet-scale load test has not been published. Roadmap (planned, not available today): a published load test at 100k+ endpoints per tenant and sizing envelopes.", "platforms": [], "last_verified": "2026-08-23" }, { "key": "nhi_governance", "name": "Agent & machine-identity governance", "state": "ga", "label": "GA", "group": "Context", "summary": "Every AI agent, MCP server and machine key as a governed principal — effective reach (tools, credentials, egress, reachable cloud data), owner, business-criticality and lifecycle. Recertify or schedule decommission; the decision is recorded and audited, and removal is carried out in your IdP or cloud provider. Newly discovered identities start as proposed and are reviewed before they are active.", "last_verified": "2026-10-12" }, { "key": "data_lineage", "name": "AI data lineage and reach", "state": "ga", "label": "GA", "group": "Context", "summary": "For every cloud data store, which AI agents and workload identities can reach it and via how many attack paths. Permission-permits-access reachability from the cloud graph — not observed retrieval.", "last_verified": "2026-08-24" }, { "key": "change_risk", "name": "Change-risk simulator", "state": "ga", "label": "GA", "group": "Context", "summary": "Predict the security effect of a proposed change — widen a workload's access, or expose a store publicly — on the current cloud graph, before you make it. A deterministic blast-radius forecast, not a claim of exploitability.", "last_verified": "2026-09-06" }, { "key": "supply_chain_trust", "name": "AI supply-chain trust registry", "state": "ga", "label": "GA", "group": "Test", "summary": "Every AI library, MCP server and skill on the fleet with a trust verdict — known-CVE, unpinned, untrusted source — a fleet-wide approve/quarantine decision and a Verified filter for what has passed review. A release gate over your AIBOM.", "last_verified": "2026-09-06" }, { "key": "continuous_red_team", "name": "Continuous AI red-team", "state": "ga", "label": "GA", "group": "Test", "summary": "A curated adversarial pack library aligned to OWASP LLM Top 10 and MITRE ATLAS, run against an authorized target with pass/fail and regression. Per discovered agent, one test scope covers behavior tests, cloud attack paths in both directions, attack chains and related findings, with a verdict per item: Proven, Not reproduced, Could not test or Evidence only. Runs without an authorized target are clearly labelled samples. The suite includes tool-poisoning and insecure-output tests.", "last_verified": "2026-10-12" }, { "key": "appsec_cicd_gates", "name": "AI code and CI/CD gates", "state": "ga", "label": "GA", "group": "Test", "summary": "Per code location, the AI-specific issues a pre-merge gate catches — hardcoded AI secrets, vulnerable or unpinned AI dependencies, untrusted MCP and skills, AI-authored code pending review — and a pass, warn or block verdict. Each AI-authored repository carries a review state; you upload the results of your own SAST and secrets tools (SARIF), and an engineer's sign-off is recorded and withdrawn if a newer result has blocking findings. Sargha does not run the scanners.", "last_verified": "2026-10-16" }, { "key": "execution_traces", "name": "AI execution traces (AIDR)", "state": "ga", "label": "GA", "group": "Runtime", "summary": "Reconstruct what an AI system did — user, prompt, retrieval, model, agent, tool, resource, outcome — from OpenTelemetry GenAI telemetry, for investigation. Each step is chained to the one before it and checked against signed checkpoints, so an edited, removed or re-ordered step is found and located, and a trace can be shown to be unaltered since it was written. This does not prove the events in it were true. Observe mode for investigation; in-line response needs an enforcement point. Roadmap (planned, not available today): live response actions from a trace.", "last_verified": "2026-10-16" }, { "key": "api_inventory", "name": "API endpoint inventory", "state": "ga", "label": "GA", "group": "Govern", "summary": "The API endpoints behind your systems beside the AI asset inventory. Upload an OpenAPI description per service and feed in what is really called (execution traces with HTTP attributes, or access-log summaries). Endpoints called but never described are undocumented, deprecated endpoints still in use are flagged, and AI-related endpoints and documented endpoints with no authentication are counted. Only method, host, path shape and counts are kept — never query strings, headers or bodies. It answers the OWASP API9 inventory question; it does not scan or probe your APIs.", "platforms": [ "OpenAPI upload", "Execution traces", "Access-log summaries" ], "last_verified": "2026-10-16" }, { "key": "ai_system_register", "name": "AI system register and EU AI Act conformity", "state": "ga", "label": "GA", "group": "Govern", "summary": "Every AI system in use, classified for conformity: EU AI Act risk tier, provider or deployer role, accountable owner and lifecycle. One register covers AI apps, agent frameworks, RAG applications and non-human identities, each with a type. An accountable, audit-stamped human classification — not an automated legal determination. Each system lists the obligations its tier triggers, with the evidence Sargha holds for each, and you can link or upload your own model cards, human-oversight design, incident runbooks and post-market monitoring records, with an owner and a review date. Runtime injection and exfiltration signals are shown on the system they belong to, where an application flags them; Sargha never reads prompts.", "last_verified": "2026-10-16" }, { "key": "mcp_server", "name": "AI assistant access (MCP server)", "state": "ga", "label": "GA", "group": "Govern", "summary": "A local assistant connection that gives an AI assistant (Claude Desktop, Claude Code, Cursor, Codex or any compatible client) read-only access to your tenant: posture, prioritized risks, AI inventory (AIBOM), cloud attack paths, compliance, detection quality and search. Access is a scoped, revocable key, and the key can never change anything. One opt-in action starts a read-only cloud posture scan behind an extra permission, with an audit record. The connection runs locally, so web-based assistants cannot connect to it today. Roadmap (planned, not available today): a hosted remote endpoint for web-based assistants.", "platforms": [ "Claude Desktop", "Claude Code", "Cursor", "Codex", "Compatible clients" ], "last_verified": "2026-08-25" }, { "key": "scheduled_reports", "name": "Scheduled posture reports", "state": "ga", "label": "GA", "group": "Govern", "summary": "Scheduled posture reporting — an HTML email summary plus a PDF executive summary and a detailed report, generated from the same evidence the console shows. Enabled per tenant through license entitlement. Reporting and evidence, not a certification of your organization.", "platforms": [ "HTML email", "PDF executive summary", "Detailed report" ], "last_verified": "2026-08-25" }, { "key": "signed_releases", "name": "Signed, verifiable sensor releases", "state": "ga", "label": "GA", "summary": "Releases are built and signed through a scripted pipeline, kept immutable, and published with checksums. Sensors verify a release before updating. Linux builds carry a second signature, Windows builds are Authenticode-signed with an EV certificate, and macOS builds are signed with an Apple Developer ID by Araghatta LLC and notarized by Apple. Each release ships a signed CycloneDX software bill of materials.", "platforms": [ "Linux (signed)", "macOS (signed, notarized)", "Windows (signed)" ], "last_verified": "2026-10-15" }, { "key": "grc_risk_register", "name": "GRC risk register & assessment", "state": "ga", "label": "GA", "group": "Govern", "summary": "Per-tenant AI risk register with auto-draft from findings, CSV import and export, a likelihood-and-impact heat map, inherent and residual scoring, a status workflow and a full audit trail; framework mapping to NIST AI RMF, ISO 42001 and the EU AI Act (reviewer guidance, not certification). A risk that names one asset takes its likelihood and impact from the eleven-fact explainable model, and each row shows the proof behind its score.", "platforms": [], "last_verified": "2026-10-12" }, { "key": "asset_page", "name": "One page per asset", "state": "ga", "label": "GA", "summary": "Open any component, MCP server, finding, threat or machine and see where it lives, who owns it, what it can reach, its attack paths, what changed, its open issues and the decisions taken, on one page.", "platforms": [ "Components", "MCP servers", "Findings", "Machines" ], "last_verified": "2026-10-06" }, { "key": "fix_as_code", "name": "Fix as code", "state": "ga", "label": "GA", "summary": "The fix as something you can copy and review: a version-pin patch, a pull-request script, a credential-rotation script, DNS and proxy block lists, a cloud deny policy and device-management removal scripts. No secrets in any artifact; nothing is applied for you. Decision as code: a script with a service API key limited to decisions can record approve, quarantine or accept-risk. Roadmap (planned, not available today): credential rotation that calls the provider, and complete DNS, proxy and cloud deny policies.", "platforms": [ "Pin patch", "Rotation script", "Block lists", "Deny policy" ], "last_verified": "2026-10-12" }, { "key": "risk_rating_model", "name": "Explainable asset rating", "state": "ga", "label": "GA", "summary": "Every asset rating is likelihood times impact from recorded facts, each with its proof, what would lower it, what is not recorded and whether the facts support the detection engine's label. Using the calculated rating records a time-limited severity override.", "platforms": [ "Likelihood", "Impact", "Counterfactuals" ], "last_verified": "2026-10-06" }, { "key": "role_views", "name": "Views by role and weekly digest", "state": "ga", "label": "GA", "summary": "The same facts arranged for a CISO, security engineer, developer or auditor, with fix groups that turn many items into one piece of work, the first proven attack path, and an opt-in weekly change digest. Roadmap (planned, not available today): views scoped by permission.", "platforms": [ "CISO", "Security engineer", "Developer", "Auditor" ], "last_verified": "2026-10-06" }, { "key": "time_travel", "name": "Time travel", "state": "ga", "label": "GA", "summary": "See the AI estate as it was on a past date and what has changed since, rebuilt from first-seen and removal times and the posture readings recorded at the time. Cloud attack paths are replayed from when each was first and last seen.", "platforms": [ "Estate", "Posture", "Cloud paths" ], "last_verified": "2026-10-06" }, { "key": "approved_ai_catalog", "name": "Approved AI catalog", "state": "ga", "label": "GA", "summary": "Which AI tools are approved, approved with conditions or not allowed. Anyone with a console account can ask for a tool, Sargha runs automated checks, and an administrator decides; a request can also be sent back for more information. A decision updates the approved and blocked lists the sensors use. Each entry has a review-by date; when it passes, the entry returns to its owner in a review queue, and owners are reminded as it comes due. Sargha also checks what a tool can reach in your environment.", "platforms": [ "Requests", "Automated review", "Separation of duties" ], "last_verified": "2026-10-12" } ], "roadmap": { "url": "https://araghatta.com/roadmap.html", "data": "https://araghatta.com/assets/data/roadmap.json", "note": "Planned capabilities. None is available today. This registry lists only what is generally available." } }