What the Vault Does
A methodology engine. The vault encodes how an analyst works: the tool chains, prompt templates, runbooks, model configurations, and hard-won reference knowledge that turn a one-off investigation into a repeatable, auditable process. Every artifact is machine-readable, navigable from the CLI, and consumable by LLM agents. The payoff is expertise that lives in a system — available to every analyst and agent who needs it, and steady whoever is at the keyboard.
Documented methodology
Every investigation type has a documented skill: tool chains, commands, output formats, and lessons learned. Why it helps: analysis stays consistent across cases and analysts, so quality no longer depends on who happens to be at the keyboard or whether a step was remembered.
[investigation type]
|
v
+------------------+
| skill file |
| tool chains |
| commands. output |
| lessons learned |
+--------+---------+
v
+------------------+
| same procedure |
| every analyst |
| every case |
+--------+---------+
v
[defensible result]LLM-native
Structured frontmatter, navigation tables, and model-config profiles let AI agents read, route, and execute work directly from the vault. Why it helps: the same methodology a human follows can be driven by an autonomous agent, multiplying output while keeping the rigour intact.
[vault content]
|
v
+-----------------+
| structured |
| frontmatter + |
| nav tables |
+--------+--------+
v
+-----------------+
| agent reads, |
| routes, runs |
| CLI . MCP |
+--------+--------+
v
[human rigour at
agent scale]Self-improving
A curation loop distils session observations into permanent methodology — flagged, reviewed, and promoted into skill files over time. Why it helps: every investigation makes the next one faster, and hard-won lessons are captured before they are forgotten.
[session work]
|
v
+----------------+
| flag candidate |
| observations |
+-------+--------+
v
+----------------+
| analyst review |
| genuine lesson?|
+-------+--------+
yes | no --> [drop]
v
+----------------+
| promote into |
| skill files |
+-------+--------+
v
[next run faster]Discipline by design
Masked-credentials inventory, strict trust-zone separation, and untrusted-input handling are built into the structure from the ground up. Why it helps: secrets stay out of the wrong context and a malicious sample cannot quietly poison the analysis that examines it.
[untrusted input]
|
v
+-----------------+
| trust zones |
| quarantine + |
| defang |
+--------+--------+
v
+-----------------+
| masked creds |
| inventory only |
+--------+--------+
v
+-----------------+
| analysis reads |
| data -- never |
| executes it |
+-----------------+Formally modelled
A single ontology names the entity classes the work deals with — actors, samples, indicators, narratives, findings, outputs — and the relations between them, published as both a human map and a machine-readable schema. Why it helps: the whole knowledge base shares one vocabulary, so tools, agents, and analysts name the same things the same way, and the model can be queried, validated, and reasoned over as a graph.
[the work]
|
v
+------------------+
| typed entities |
| actor. sample. |
| IOC. narrative |
+--------+---------+
v
+------------------+
| shared grammar |
| finding + source |
| + confidence |
+--------+---------+
v
+------------------+
| layered model |
| foundation up to |
| specialised |
+--------+---------+
v
+------------------+
| human map + |
| machine schema |
+--------+---------+
v
[queryable graph]Capability Domains
Reusable skills span the full analyst lifecycle — from a raw sample or a single name to a finished report, IOCs in a sharing platform, and tuned detections in production. Each one packages an entire discipline into a repeatable procedure, so a single analyst can take on work across domains and reach a defensible result the same way every time.
Malware Analysis
Static and dynamic analysis of ELF/Linux and Windows PE samples — reversing, capability triage, and family identification with documented tool chains. Purpose: understand exactly what a sample does and how dangerous it is, so detection and response decisions rest on evidence.
[sample intake]
| hash + quarantine
v
+-----------+ +------------+
| STATIC | | DYNAMIC |
| strings |-->| sandboxed |
| disasm | | behaviour |
| capa map | | net trace |
+-----------+ +-----+------+
|
+--------------+
v
+----------------+
| CAPABILITY |--> family id
| ASSESSMENT | verdict +
+----------------+ evidenceYARA & Signatures
Generate YARA / Sigma / Suricata signatures straight from analysis output, validated before release. Purpose: turn a single sample into reusable detection, so a SOC can catch the whole family across the estate and block it at the network edge.
[analysis output]
|
v
+----------------+
| feature select |
| strings. bytes |
+--------+-------+
v
+----------------+
| rule authoring |
| YARA . Sigma . |
| Suricata |
+--------+-------+
v
+----------------+ fail
| validate vs |------+
| corpus + FPs |<-----+
+--------+-------+ tune
v
[release to SOC]Threat Research & IOC Enrichment
Pivot and enrich indicators across intelligence sources, then push structured IOCs to a sharing platform. Purpose: reconstruct an adversary's wider infrastructure from a single clue, so one alert becomes a map of the campaign that others can act on.
[seed IOC]
|
v
+--------------+
| enrich |
| WHOIS . pDNS |
| VT . certs |
+------+-------+
v
+--------------+ new IOCs
| pivot |-------+
| infra map |<------+
+------+-------+ loop
v
+--------------+
| structure + |
| tag + score |
+------+-------+
v
[MISP event]Phishing-Kit De-Cloaking
Take a single live phishing link, defeat the victim-only cloak from a country-matched vantage, safely retrieve the kit's own source, and de-cloak the hosting to the real origin server and its wider domain fleet. Purpose: turn one throwaway phishing URL into a map of the operator's whole infrastructure and a clear account of what the kit harvests and where it sends it, ready for a takedown package.
[live phishing URL]
|
v
+----------------+
| detect cloak |
| geo . ASN . UA |
+-------+--------+
v
+----------------+
| bypass via |
| matched vantage|
+-------+--------+
v
+----------------+
| retrieve kit |
| fetch-not-run |
+-------+--------+
v
+----------------+
| deobfuscate |
| fields . crypto|
+-------+--------+
v
+----------------+
| de-cloak origin|
| apex . pDNS |
| . cert CN |
+-------+--------+
v
[fleet + MISP event]OSINT & Investigations
Person-of-interest profiling, media influence-operation analysis, and compound court / actor / narrative investigations, including dark-web synthesis. Purpose: establish identity, affiliations, and conflicts of interest from minimal starting input, with each finding linked to its basis.
[name/handle/domain]
|
v
+-------------------+
| footprint sweep |
| social . records |
| media . dark web |
+---------+---------+
v
+-------------------+
| cross-verify |
| source scoring |
+---------+---------+
v
+-------------------+
| link analysis |
| entities . assets |
+---------+---------+
v
[evidenced profile]Behavioral Analysis
Seven behavioral-analysis methods for profiling threat actors and influence operations: coordinated-behavior detection (CIB), psycholinguistics, forensic analysis, threat assessment, nudge, psychographic, and social. Purpose: explain who is behind a campaign, how they think, and how a narrative takes hold and spreads.
[campaign / actor data]
|
v
+------------------------+
| 7 METHOD LANES |
| |
| CIB psycholing. |
| forensic threat asmt |
| nudge psychograph |
| social network |
+-----------+------------+
v
+------------------------+
| triangulated |
| behavioural profile |
| motive . MO . spread |
+------------------------+Structured Analytics
Structured analytic techniques for rigorous intrusion analysis — SATs, ACH (Analysis of Competing Hypotheses), the Diamond Model, and ATT&CK / Cyber Kill Chain mapping. Purpose: keep judgement rigorous and defensible, guarding against analyst bias and turning a hunch into a scored, reviewable conclusion.
[competing hypotheses]
|
v
+------------------+
| ACH matrix |
| evidence vs |
| hypotheses |
+--------+---------+
v
+------------------+
| Diamond model |
| adversary. infra |
| capability.victim|
+--------+---------+
v
+------------------+
| ATT&CK / kill- |
| chain mapping |
+--------+---------+
v
[scored judgement]Intelligence Requirements & RFI
Turn incoming questions into defensible answers: standing intelligence requirements, a scoped request lifecycle, and an answer structure that keeps evidence separate from assessment. Purpose: answer the question actually asked, with reasoning visible and remediation ordered so the recipient can act without another round trip.
[question in]
|
v
+----------------+
| scope: restate |
| + decision at |
| stake |
+-------+--------+
v
answerable?
| |
yes no
| +-> [gap named]
v
+----------------+
| evidence |
| facts, cited |
+-------+--------+
v
+----------------+
| assessment + |
| confidence |
+-------+--------+
v
+----------------+
| remediations |
| ordered |
+----------------+Threat Modeling
Model a system’s attack surface with the framework that fits the job — STRIDE / STRIDE-LM, PASTA, VAST, OCTAVE, and LINDDUN for privacy — with a selection guide and combination patterns. Purpose: design weaknesses surface at the design stage, where they are cheapest to fix and easiest to prevent.
[system design]
|
v
+------------------+
| decompose |
| assets . flows |
| trust boundaries |
+--------+---------+
v
+------------------+
| framework fit |
| STRIDE . PASTA |
| LINDDUN . VAST |
+--------+---------+
v
+------------------+
| enumerate |
| threats on DFD |
+--------+---------+
v
[ranked mitigations]Risk Assessment
Quantify security risk in financial terms — FAIR factor analysis, Monte Carlo and Beta-PERT simulation, FMEA, and governance mapping to NIST RMF and ISO 27005. Purpose: turn a vague sense of exposure into a defensible loss distribution that leadership can prioritise and budget against.
[risk scenario]
|
v
+------------------+
| FAIR factors |
| freq x magnitude |
+--------+---------+
v
+------------------+
| Monte Carlo |
| Beta-PERT |
| 10k+ simulations |
+--------+---------+
v
+------------------+
| loss exceedance |
| curve |
+--------+---------+
v
[budgetable decision]Detection Engineering
Author and tune detection rules with a full reference library: query language, field paths, LOLBin / GTFOBin patterns, ATT&CK coverage maps, and quality metrics. Purpose: ship high-fidelity detections that catch attacker behavior while keeping false positives low enough to stay trusted.
[intel / hunt finding]
|
v
+-------------------+
| behaviour -> |
| query logic |
+---------+---------+
v
+-------------------+
| field mapping |
| per log source |
+---------+---------+
v
+-------------------+ noisy
| FP baseline + |------+
| suppression |<-----+
+---------+---------+ tune
v
[production rule]
ATT&CK-taggedIdentity-Plane Detection
Detect attacks on the identity layer — device-code phishing, adversary-in-the-middle token theft, illicit mailbox rules, and OAuth consent abuse — across sign-in, audit, and identity-provider logs. Purpose: cover the plane where a large share of modern intrusions begin, with the fields, error codes, and false-positive sources mapped in advance.
[identity telemetry]
sign-in . audit . IdP
|
v
+------------------+
| attack class |
| device-code |
| AiTM . consent |
+--------+---------+
v
+------------------+
| field + error |
| code mapping |
+--------+---------+
v
+------------------+ benign
| baseline apps + |-----+
| own egress ASN |<----+
+--------+---------+ tune
v
[rule + FP notes]Detection Efficacy & Coverage
Measure whether a detection portfolio works from analyst outcomes on the alerts it produced: precision per rule, where volume concentrates, tune-suppress-retire decisions, and whether a mapped technique is genuinely alive. Purpose: aim tuning at the rules consuming the analyst budget, and keep coverage claims honest.
[alerts + verdicts]
|
v
+------------------+
| precision per |
| rule (outcomes) |
+--------+---------+
v
+------------------+
| volume concentr. |
| top-N burden |
+--------+---------+
v
tune . suppress
retire . keep
|
v
+------------------+
| coverage: intel |
| -> technique -> |
| rule -> liveness |
+--------+---------+
v
[gap findings]Threat Hunting
Hypothesis-driven proactive hunting across endpoint, network, and log telemetry — a structured hunt loop, scenario decision trees, query banks, and a findings-to-detection feedback path. Purpose: surface adversary activity that slipped past existing alerts, and turn a repeatable hunt into a permanent detection.
[hypothesis] ATT&CK-anchored
|
v
+----------------+
| scope data |
| endpoint . net |
| log telemetry |
+-------+--------+
v
+----------------+
| query banks |
| stack. cluster |
+-------+--------+
v
findings?
| |
yes no
| +--> [document null]
v
+----------------+
| escalate + new |
| detection rule |
+----------------+Compromise Assessment
A bounded, retrospective sweep of an entire estate — standardised hunt packs per platform, scoped exclusions, staggered collection, and an audience-structured report. Purpose: tell a decision-maker whether the estate is compromised now or was compromised undetected, with the coverage and retention limits that bound the answer stated up front.
[engagement scope]
|
v
+------------------+
| coverage check |
| + exclusion list |
+--------+---------+
v
+------------------+
| standard hunt |
| pack per OS |
+--------+---------+
v
+------------------+
| staggered |
| collection |
+---+----------+---+
| |
v v
[live find] [sweep data]
handover |
immediate v
+--------------+
| findings + |
| nulls, ATT&CK|
+------+-------+
v
[report + limits]Vulnerability Research
Audit, fuzz, and develop PoCs against binaries, with findings and patches documented. Purpose: surface weaknesses before an attacker does and prove them with a working PoC, so fixes are prioritised on real, demonstrated risk.
[target binary]
|
v
+----------------+
| audit surface |
| parsers. input |
+-------+--------+
v
+----------------+
| fuzz harness |
| coverage-led |
+-------+--------+
v
+----------------+
| triage crashes |
| exploitable? |
+-------+--------+
v
+----------------+
| PoC + patch |
+-------+--------+
v
[coordinated disclosure]Autonomous Code Audit
Loop a whitebox audit across a whole codebase: enumerate every component, generate candidate findings at each altitude from whole-project to single function, then adversarially verify each one against the raw source before it counts. Purpose: surface far more real, proven vulnerabilities than a single pass, with a coverage ledger showing every component was examined and a verify step that filters out false positives.
[source tree]
|
v
+----------------+
| enumerate all |
| components |
+-------+--------+
v
+----------------+
| generate (raw) |
| every altitude |
+-------+--------+
v
+----------------+
| judge / refute |
| from raw |
+-------+--------+
v
+----------------+
| live-verify |
| survivors |
+-------+--------+
v
+----------------+
| ledger + loop |
| until dry |
+-------+--------+
v
[coordinated disclosure]Agentic Engineering
Patterns for building agentic systems and agentic SOC workflows — RAG infrastructure, token/cost optimisation, state and reliability design. Purpose: scale analyst work with automation that stays reliable and affordable as volume grows.
[task]
|
v
+--------------+
| orchestrate |
| plan . route |
+------+-------+
v
+--------------+ +-----------+
| agent loop |<->| tools |
| act. observe | | RAG . MCP |
+------+-------+ +-----------+
v
+--------------+
| state + |
| guardrails |
+------+-------+
v
[auditable output]Agent Runtime Isolation
Map where an agent's actions are actually constrained — prompt rules, tool schemas, in-server guards, kernel confinement, egress policy — and which of those layers still hold once the agent's context is captured. Purpose: judge an agent runtime by what its containment survives before trusting it with untrusted content.
[agent runtime]
|
v
+---------------------+
| layer map |
| prompt . schema |
| guard . kernel |
+----------+----------+
v
+---------------------+
| which layers hold |
| under capture |
+----------+----------+
v
+---------------------+
| egress default-deny |
| credential custody |
+----------+----------+
v
+---------------------+
| escape test |
+----------+----------+
v
[containment verdict]AI Security & Red Teaming
Defensive AI architecture (lethal trifecta, taint tracking, MCP attack classes), ML/NLP foundations for red teaming, and IoPC detection taxonomy. Purpose: as attackers begin to target LLMs and agents, harden AI systems and pressure-test them the way a real adversary would.
[AI system target]
|
v
+-------------------+
| surface map |
| prompts. RAG. MCP |
| tools . memory |
+---------+---------+
v
+-------------------+
| attack classes |
| injection . exfil |
| tool abuse |
+---------+---------+
v
+-------------------+
| lethal-trifecta |
| check + taint |
+---------+---------+
v
[hardening report]Uncensored-Model Detection
A four-layer detector that identifies open-weight language models whose safety alignment has been stripped or weakened, and attributes how it was done, reading published provenance, weight-space geometry, activation-space probes, and behavioral benchmarks. Purpose: as safety-removed models spread across research hosts and criminal services, defenders can tell whether an unknown model has had its guardrails removed and by which method, then flag, attribute, and monitor it.
[ unknown model ]
|
v
+-------------------+
| L1 provenance |
+---------+---------+
v
+-------------------+
| L2 weight-space |
+---------+---------+
v
+-------------------+
| L3 activation |
+---------+---------+
v
+-------------------+
| L4 behavioral |
+---------+---------+
v
[ verdict + method ]AI Governance & Compliance
Maps security-testing and red-team work to the regulation that now governs it: which compliance frameworks accept autonomous / AI-driven pentest evidence and which still require a credentialed human, plus the legislation that mandates adversarial testing of AI systems — EU AI Act, NIST AI RMF, and ISO/IEC 42001 — with clause references verified against primary sources. Purpose: so a red-team or pentest result lands as audit-ready evidence in the right regulatory frame, and AI systems are tested to the standard the law now expects.
[red-team / pentest
evidence]
|
v
+------------------+
| framework map |
| EU AI Act |
| NIST AI RMF |
| ISO/IEC 42001 |
+--------+---------+
v
+------------------+
| acceptance matrix|
| AI-driven vs |
| human-credential |
+--------+---------+
v
[audit-ready package]Digital Risk Protection
Monitor and triage external exposure — lookalike domains, leaked credentials and documents, exposed services, and brand or executive impersonation — with a graded verdict per finding. Purpose: catch what is visible from the outside before it gets used, and route each finding with the evidence its response path requires.
[external signal]
|
v
+-----------------+
| classify family |
| phish . leak |
| exposure. brand |
+--------+--------+
v
+-----------------+
| verify live + |
| verify ownership|
+--------+--------+
v
graded verdict
|
v
+-----------------+
| evidence per |
| response path |
+--------+--------+
v
[route: takedown
reset . rotate]Remediation & Takedown
Platform takedown and remediation matrices for fake profiles, phishing domains, and leaked-credential scenarios. Purpose: move from finding a threat to removing it, with the right contact, evidence package, and escalation path mapped out in advance.
[confirmed threat]
|
v
+-----------------+
| classify |
| profile. domain |
| leaked creds |
+--------+--------+
v
+-----------------+
| evidence pack |
| per platform |
+--------+--------+
v
+-----------------+
| submit + |
| escalation path |
+--------+--------+
v
[removal verified]End-to-End Workflows
Multi-step runbooks chain skills into complete pipelines — for example, taking a dangerous-looking artifact safely from intake to shareable intelligence. They remove the seams between steps, so a whole investigation runs as one continuous, auditable flow with nothing dropped at the hand-offs.
defang & quarantine
static / dynamic
YARA / Sigma
IOC pivoting
MISP ingestion
shareable intel
Threat-Article Ingestion
Safely bring dangerous-looking source material into the knowledge base with untrusted-input handling, defanging, and payload quarantine. Purpose: learn from live threat content while the content itself stays contained and harmless.
[dangerous article]
|
v
+-----------------+
| untrusted-input |
| handling |
+--------+--------+
v
+-----------------+
| defang IOCs + |
| quarantine |
| payloads |
+--------+--------+
v
+-----------------+
| extract intel |
| safely |
+--------+--------+
v
[vault knowledge]Campaign Runbooks
Dedicated end-to-end playbooks for known campaign families, capturing the full investigative sequence. Purpose: when a known threat resurfaces, the complete response is ready to run start to finish, with nothing rebuilt by hand under pressure.
[known campaign
resurfaces]
|
v
+----------------+
| dedicated |
| runbook |
| intake->report |
+-------+--------+
v
+----------------+
| chained skills |
| analyse. sign. |
| enrich. share |
+-------+--------+
v
[full response,
nothing rebuilt]Session Logging & Continuity
Dual-write session indexing with resume pointers across every working host. Purpose: long, multi-step investigations survive restarts and hand-offs, with a clear audit trail of what was done and where to pick up.
[session starts]
|
v
+----------------+
| dual-write log |
| local + vault |
+-------+--------+
v
+----------------+
| milestones + |
| resume pointer |
+-------+--------+
v
interrupted?
| |
yes no
| |
v v
[resume [audit
exactly] trail]Reference Knowledge
Beyond skills, the vault carries curated reference material that analysts and agents draw on mid-investigation, kept as living summaries of concepts, patterns, and methodology. It puts hard-won context within reach at the moment of decision, so accuracy holds up under time pressure and never rides on memory alone.
A breadth of reference domains.
Summary-level knowledge spans malware behavior, threat-actor tradecraft, the evolving AI threat landscape, reverse-engineering fundamentals, detection reference material, agentic-SOC architecture, and defensive-AI patterns — plus an investigations index so prior work is never duplicated. Each is maintained as a digestible overview that points to deeper methodology when needed.
Automation & Orchestration
The vault is wired for hands-off operation across machines and channels. Upkeep, sync, and routine collection run on their own, so the system stays current and consistent everywhere while analyst attention goes to the work that genuinely needs human judgement.
Scheduled Cloud Routines
Recurring automated agents keep intelligence fresh and the vault tidy, digesting new threats and surfacing curation work on a schedule. Purpose: routine upkeep runs on its own, freeing analyst time for judgement and deep work.
[cron schedule]
|
v
+----------------+
| cloud agents |
| threat digest |
| vault hygiene |
| curation queue |
+-------+--------+
v
+----------------+
| commit results |
| append-only |
+-------+--------+
v
[fresh vault, no
analyst time]Multi-Host Sync
Git-versioned and synchronised across a host mesh with strict, linear, append-only discipline and signature-preserving history. Purpose: the same knowledge is available and trustworthy on every machine, with a tamper-evident record of every change.
[commit on host A]
|
v
+-----------------+
| git push |
| ff-only. linear |
| signed history |
+--------+--------+
v
+-----------------+
| fan-out pull |
| to host mesh |
+--------+--------+
v
[same knowledge
everywhere]Remote Orchestration
A command bot provides remote control-plane access to routing and operations from anywhere. Purpose: investigations can be launched and steered without sitting at the workstation, so response is never tied to one location.
[analyst, anywhere]
|
v
+-----------------+
| secure bot |
| channel |
+--------+--------+
v
+-----------------+
| command router |
| status. launch |
| steer |
+--------+--------+
v
+-----------------+
| working hosts |
+-----------------+Canonical Pipeline Scripts
A single source of truth for pipeline scripts keeps automated and manual runs aligned. Purpose: results stay reproducible whoever runs them and however they are triggered.
[one source of truth]
|
v
+------------------+
| versioned script |
| library |
+----+--------+----+
| |
v v
+--------+ +--------+
| manual | | auto |
| runs | | runs |
+---+----+ +----+---+
\ /
v v
[identical results]Multi-Model Routing
A task-to-model routing layer picks the right engine per job across frontier APIs and local, offline models, matching capability, cost, and privacy to the work. Purpose: quality-critical work reaches the strongest model while bulk and sensitive tasks run locally, holding cost down and keeping private data in-house.
[task arrives]
|
v
+----------------+
| routing matrix |
| capability. |
| cost. privacy |
+---+--------+---+
| |
v v
+--------+ +---------+
| frontier| | local |
| APIs | | offline |
+----+---+ +----+----+
\ /
v v
[right model per job]Hybrid-Threat Fusion
Links coordinated influence activity to the cyber infrastructure and actors behind it, building a source-cited evidence graph that keeps how-confident-it-is-coordinated separate from who-is-behind-it. Purpose: the narrative layer and the infrastructure layer are read as one case, so an influence campaign and the adversary operating it surface together, with every claim traceable to its source.
[narrative signals]
|
v
+----------------+
| infra enrich |
| pDNS/cert/VT |
+----------------+
|
v
+----------------+
| cluster: shared|
| infrastructure |
+----------------+
|
v
+----------------+
| score: |
| detection vs |
| attribution |
+----------------+
|
v
+----------------+
| grounding gate |
| no uncited |
| claim |
+----------------+
|
v
[MISP + DISARM
event + report]Why It Matters
One disciplined system, many capabilities.
The Eolas Vault turns scattered expertise into an operational asset: consistent methodology, reusable across machines and models, safe by construction, and continuously improving. Whether driven by a human analyst or an autonomous agent, the work is repeatable, auditable, and ready to scale.
Open Blueprint
Start your own vault
The Training Knowledge Vault is a live, public, sanitised blueprint of the concept that grew into the Eolas Vault — the same structure at a teaching scale, shared openly so anyone can learn the method. Purpose: a working template to fork, study, and grow into a knowledge base of your own, and a shared starting point for the journey.
github.com/Eolas-bith/training-knowledge-vault [ training vault ]
public blueprint
|
v
[ fork / clone ]
|
v
[ study + adapt ]
|
v
[ build your own ]