Classification :: UNCLASSIFIED // FOR DEVELOPMENT USE
Operational Status :: LIVE

Real-timeAdversaryVisibility.

The first AI-native unified cyber intelligence platform built on NSA open-source foundations. Fuses five intelligence-grade components into one operator console for government and critical infrastructure.

Services
6
microservices
OT Vendors
3
signature sets
Stages
7
emissary workflow
◢ SENSOR 01
BEARING 270° ◤
SENSOR :: SURICATA ONLINEOT-FINGERPRINT :: SIEMENS S7 · ROCKWELL ENIP · SEL FMGRAPH :: LEMONGRAPH NSABINARY :: GHIDRA 12.1 HEADLESSINTEL :: CLAUDE OPUSWORKFLOW :: EMISSARY DATA-DRIVENTRANSPORT :: TLS 1.3 / HSTSSCHEMA :: MULTI-TENANT // CELL-LEVEL ACLEXPORT :: STIX 2.1MITRE :: ATT&CK FOR ICSSENSOR :: SURICATA ONLINEOT-FINGERPRINT :: SIEMENS S7 · ROCKWELL ENIP · SEL FMGRAPH :: LEMONGRAPH NSABINARY :: GHIDRA 12.1 HEADLESSINTEL :: CLAUDE OPUSWORKFLOW :: EMISSARY DATA-DRIVENTRANSPORT :: TLS 1.3 / HSTSSCHEMA :: MULTI-TENANT // CELL-LEVEL ACLEXPORT :: STIX 2.1MITRE :: ATT&CK FOR ICS
§02 · CAPABILITIES

Five intelligence components. One platform.

Each capability runs as an isolated microservice behind raven-core. Add or replace a place to extend the pipeline.

§01
Suricata · ELITEWOLF
Network Threat Detection

Line-rate IDS with NSA OT signatures for Siemens S7, Rockwell ENIP, and SEL relays.

§02
Ghidra 12.1 headless
Binary Artifact Analysis

Automated headless reverse engineering with IOC extraction and entropy profiling.

§03
LemonGraph
Entity Graph Intelligence

Cell-isolated graph per tenant. Streaming patterns, N-hop expansion, persistent context.

§04
Emissary pattern
Data-Driven Workflow

STUDY → ID → COORDINATE → TRANSFORM → ANALYZE → IO → REVIEW. Routing emerges from payload metadata, not a baked DAG.

§05
Claude Opus
AI Threat Interpretation

Structured incident reports, MITRE coverage, executive summaries, and STIX 2.1 export.

§03 · WORKFLOW

Data drives routing — not a baked DAG.

Every payload accumulates metadata as it flows. The dispatcher inspects that metadata to choose the next stage.

EMISSARY PIPELINE
stage 01
STUDY
stage 02
ID
stage 03
COORDINATE
stage 04
TRANSFORM
stage 05
ANALYZE
stage 06
IO
stage 07
REVIEW
TERMINAL
IBaseDataObject
RavenPayload

Carries tenant, event type, stage, accumulating metadata, and processing history.

ServiceProviderPlace
PlaceRegistry

Each place advertises which event types and stages it handles. Lowest cost, highest quality wins.

MobileAgent
DataDrivenDispatcher

Hops the payload from place to place until terminal stage. No pre-baked DAG.

§04 · DEPLOYMENT

Three tiers. One mission.

RAVEN SENTINEL
$3,500per month
Detection & monitoring
  • Suricata + ELITEWOLF coverage
  • Live SSE threat feed
  • Multi-tenant dashboard
  • Email + Slack escalation
Recommended
RAVEN COMMAND
$8,500per month
Full platform — recommended
  • Everything in Sentinel
  • Ghidra binary analysis
  • Entity graph + N-hop expansion
  • Claude-powered TI reports
  • STIX 2.1 export
RAVEN SOVEREIGN
$25,000per month
Air-gapped / classified
  • On-prem deployment
  • Classified network support
  • FedRAMP-aligned audit log
  • Dedicated TAM
§05 · TECH STACK

Locked, opinionated, production-ready.

API surface
FastAPI
Workflow
Celery + Redis
Operational DB
PostgreSQL 15
Event index
Elasticsearch 8
Network IDS
Suricata 7
Binary RE
Ghidra 12.1
Entity graph
LemonGraph
AI analysis
Claude Opus
Operator UI
Next.js 14
Edge
Nginx + TLS
Runtime
Docker Compose
Orchestration
Coolify
// AUTHENTICATE

The console awaits the operator.

Cleared personnel only. All activity is logged and audited under FedRAMP-aligned controls.