1. Perimeter & Deception
perimeter-appliance integrates edge reverse-proxy filtering, decoy honeypot ports (port 2222), and strict TLS 1.3 termination without extra infrastructure.
2. Network & Lateral Movement
network-appliance enforces L4 microsegmentation alongside L7 inspection on SMB/RPC to block lateral movement and C2 beaconing.
3. Endpoint & Host Services
endpoint-appliance pairs kernel-level process interception with vms-scanner workload profiles (auditing LDAP, Kerberos, Samba AD, and local privilege escalation).
4. Application & Omnipresent DLP
application-appliance provides OWASP CRS protection and outbound response data loss prevention (PCI card masking, PII protection) at runtime.
5. Data & SQL AST Shield
data-appliance inspects database queries using AST tokenization for tautology prevention and enforces bulk row exfiltration limits.
6. SaaS & Identity Governance
security-appliance enforces Kerberos/LDAP identity defenses and saas-scanner audits Microsoft 365, Google Workspace, and GitHub postures.
Profile Activation
Pass profile flags directly to existing container workloads: --profile=identity for Active Directory checks on VMs, --enable-deception-traps=true for perimeter honeypots, and --enable-dlp=true for application data loss prevention.