secure cti platform

CTI platform for SOC teams and MSSPs. Real tenant isolation, IOC scoring, STIX/TAXII native, and direct EDR integrations

Comment

H0 — Secure CTI Platform

Inspiration

Every SOC team we talked to had the same problem: their threat intelligence lived in spreadsheets, disconnected feeds, and tools that claimed to be "multi-tenant" but enforced isolation with a simple WHERE tenant_id = ? in the application layer.

One misconfigured query. One bug. One junior developer's mistake — and every client's data is exposed to every other client.

We asked ourselves: what if tenant isolation was mathematically guaranteed by the database engine itself, not by developer discipline?

That question became H0.

The name comes from the null hypothesis — $H_0$ — the assumption you challenge before you can prove something is true. We challenged the assumption that enterprise-grade CTI had to be expensive, opaque, and architecturally unsafe.

What We Built

H0 is a multi-tenant Cyber Threat Intelligence platform that unifies:

  • IOC Management — validation, deduplication, and reputation scoring $s \in [0, 100]$ for IPs, domains, hashes, and URLs with full TLP support
  • Native STIX 2.1 / TAXII 2.1 — no adapters, no middleware
  • Detection Rules & Threat Feeds — configurable per tenant
  • EDR Push — CrowdStrike, SentinelOne, Microsoft Defender
  • FortiSOAR Connector — downloadable native connector
  • n8n Node — for automation workflows
  • Browser Extension — capture IOCs from any webpage instantly
  • 365-day Audit Trail — user, IP, action, result — ISO 27001 ready
  • Super Admin Console — feature flags, demo licenses, tenant lifecycle

The entire platform enforces a Zero Trust chain on every request:

$$ \text{Identity} \rightarrow \text{Authorization} \rightarrow \text{Tenant} \rightarrow \text{Resource} \rightarrow \text{Action} $$

No step is skipped. No shortcut is taken.

How We Built It

Stack

Layer Technology
Frontend + API Next.js 15 (App Router) on Vercel
Database Amazon Aurora PostgreSQL Serverless v2
DB Access RDS Data API over HTTPS + IAM/OIDC
Auth Opaque sessions hashed in DB, 8h TTL
Secrets AWS Secrets Manager
Isolation PostgreSQL Row Level Security (RLS)

The Architecture Decision That Changes Everything

Traditional SaaS isolates tenants in code. We isolate them in the database engine. Aurora PostgreSQL's Row Level Security policies mean that even if the application layer is compromised, a tenant cannot read another tenant's row — not even with a direct database connection.

The security guarantee is formally expressible. If $T_i$ and $T_j$ are distinct tenants and $R$ is any row in any table, then:

$$ P(\text{read}(R_{T_i}) \mid \text{session}_{T_j}) = 0 $$

This is not a policy. It is a constraint enforced by the query planner itself.

Serverless Without the Serverless Pain

Deploying a traditional PostgreSQL connection pool on Vercel Functions means running out of connections under load. We solved this by using the RDS Data API — a stateless HTTPS endpoint that executes SQL without maintaining persistent connections. No pgBouncer. No connection pool configuration. No ops overhead.

The database stays completely private — no public IP, no VPC peering required from Vercel — while remaining fully queryable from the edge.

Challenges

1. Secure by Design, Not by Convention

Writing Row Level Security policies that correctly derive tenant_id from the session — and never from client input — required rethinking every data access pattern. The tenant_id is set once at the database session level and inherited by every query automatically. This took significant iteration to get right without performance regressions.

2. STIX 2.1 Without a Library

Most STIX implementations rely on Python libraries. Building a native STIX 2.1 serializer and TAXII 2.1 server in TypeScript — with correct bundle structure, relationship objects, and collection authentication — meant reading the spec directly and implementing it from scratch.

3. Zero Trust in a Serverless Environment

Traditional Zero Trust assumes long-lived sessions with a central policy engine. On Vercel Functions, every invocation is stateless. We implemented Zero Trust by resolving the full chain $\text{identity} \rightarrow \text{tenant} \rightarrow \text{role} \rightarrow \text{permission}$ on every request using lightweight DB lookups cached at the Aurora layer — keeping p99 latency under 80ms.

4. Multi-Tenant Demo Licensing

Building a Super Admin console that could issue time-limited, feature-scoped demo licenses — with automatic expiration, IOC limits, and instant revocation — required a flexible feature flag system that evaluates on every request without adding latency. The solution: a materialized permissions snapshot cached per session, invalidated on license change.

What We Learned

Isolation is not a feature. It is an architectural property.

You cannot retrofit real multi-tenancy. It has to be designed from the first migration. Every shortcut — filtering in the ORM, trusting the frontend for tenant_id, using a shared schema without RLS — becomes a liability that compounds with every new tenant onboarded.

We also learned that the hardest problems in a security product are not the security algorithms — they are the operational guarantees: What happens when a session expires mid-request? When a license expires at midnight? When an EDR push fails halfway through? Designing for these failure modes, and making them auditable, is where most of the engineering time went.

What's Next

H0's roadmap targets the gaps that existing enterprise CTI platforms leave open: autonomous triage agents, Priority Intelligence Requirements (PIRs), a Knowledge Graph linking adversary infrastructure, Telegram and dark web monitoring, and an asset exposure engine that alerts when your own domains appear in active threat feeds.

The goal is not to be a cheaper version of existing platforms. The goal is to be the platform that does what they claim to do — and proves it at the database level.

Built With

  • amazon-aurora-postgresql-serverless-v2
  • aws-iam-(oidc)
  • aws-rds-data-api
  • aws-secrets-manager
  • browser-extension-(chrome)
  • crowdstrike-api
  • fortisoar
  • hacemos
  • lo
  • microsoft-defender-api
  • n8n
  • next.js-15
  • node.js
  • pgcrypto
  • react-19
  • rest-api
  • row-level-security-(rls)
  • sentinelone-api
  • shadcn/ui
  • stix-2.1
  • tailwind-css
  • taxii-2.1
  • vercel
Share this project:

Updates