Security Checklist
This checklist summarizes CSIRT-Pro's security controls for enterprise procurement, compliance, and IT security assessments.
1. Authentication and Access Control
| Item |
Status |
Details |
| Multi-factor Authentication (MFA) |
Supported |
Passkey (WebAuthn/FIDO2) and OAuth2/OIDC via the authentication provider |
| Single Sign-On (SSO) |
Supported |
OAuth2 Authorization Code flow with PKCE |
| Passwordless Authentication |
Supported (limited) |
WebAuthn / FIDO2 Passkeys via the authentication provider |
| API Key Authentication |
Supported |
Scoped keys for programmatic access |
| Session Management |
Implemented |
Access token (24 hours) plus refresh token; server-side session validation |
| Role-Based Access Control (RBAC) |
Implemented |
Organization-scoped permissions with user roles |
| Least Privilege Principle |
Enforced |
Users access only their organization's data; cross-org access requires explicit SharedAccess |
| Account Lockout |
Configured |
Managed by the authentication provider's policies |
| Password Policy |
Enforced |
Managed by the authentication provider; complexity and rotation policies configurable |
Session token details
Web sessions use a signed JWT carried in the jwt cookie, validated server-side.
2. Data Protection
| Item |
Status |
Details |
| Data Encryption at Rest |
Implemented |
AES-256 at rest; environment variables encrypted server-side |
| Data Encryption in Transit |
Implemented |
TLS 1.2+ for all API communications |
| Data Isolation (Multi-Tenancy) |
Implemented |
Logical separation per organization: each gets a dedicated user and dedicated views; customers cannot access the data store directly |
| Data Retention Controls |
Configurable |
Per-pipeline TTL (1 to 3650 days, or unlimited) |
| Data Deletion |
Supported |
Automatic TTL-based deletion; manual pipeline deletion |
| Credential Storage |
Encrypted |
UEBA credentials and Playbook environment variables encrypted at rest, masked in the UI |
| Sensitive Data Masking |
Implemented |
Environment variable values and credentials are masked in the user interface |
3. Network Security
| Item |
Status |
Details |
| TLS Enforcement |
Required |
All API endpoints require HTTPS |
| API Rate Limiting |
Implemented |
Per-organization rate limits; 429 Too Many Requests when exceeded |
| Rate Limit Monitoring |
Available |
GET /api/user/<user_id>/organization/throttle/ endpoint |
| Webhook Security |
Supported |
Playbook webhook endpoints are organization-scoped and authenticated |
| Input Validation |
Implemented |
API request validation on all endpoints |
4. Audit and Monitoring
| Item |
Status |
Details |
| Audit Logging |
Implemented |
User actions recorded with timestamp, user, IP, and resource details |
| Audit Log Search |
Available |
Full-text search with date-range filtering |
| Audit Log Retention |
Configurable |
Follows organization data retention policies |
| Execution History |
Recorded |
Playbook execution history with per-node logs and error details |
| Version Control |
Implemented |
Playbook version history with diff and restore |
| Login Activity Tracking |
Implemented |
Authentication events tracked via the authentication provider |
5. Application Security
| Item |
Status |
Details |
| API Documentation |
Available |
OpenAPI spec via Swagger UI (/swagger/) and ReDoc (/redoc/) |
| Input Sanitization |
Implemented |
PRQL query parsing; API request validation |
| Error Handling |
Standardized |
Structured error responses with error codes; no sensitive data in error messages |
| Dependency Management |
Maintained |
Regular updates of application dependencies |
| Code Execution Isolation |
Implemented |
Playbook Python/JS code runs in isolated function-execution environments |
6. Availability and Business Continuity
| Item |
Status |
Details |
| Cloud-Native Architecture |
Yes |
Designed for high availability and horizontal scaling |
| Data Redundancy |
Implemented |
Replicated log store; the streaming ingestion bus buffers messages |
| Health Check Endpoint |
Available |
GET /api/v2/health returns system status |
| Backup and Recovery |
Supported |
Log store backups; configuration export via JSON |
| Dashboard Export |
Available |
JSON export/import for dashboard configurations |
| Playbook Export |
Available |
Version control with full history preservation |
| Graceful Degradation |
Designed |
The streaming bus absorbs ingestion spikes; processing is asynchronous |
7. Compliance and Governance
| Item |
Status |
Details |
| Data Residency |
Domestic |
Customer data and analytics processing are kept in-country on a domestic managed-cloud region |
| Data Retention Policy |
Configurable |
Per-pipeline TTL settings (1 to 3650 days) |
| Right to Deletion |
Supported |
Pipeline and data deletion capabilities |
| Access Control Documentation |
Available |
SharedAccess permissions are explicitly defined and auditable |
| Organization Management |
Implemented |
Organization settings, member management, contact information |
| Escalation Policies |
Configurable |
Multi-channel notification (Email, SMS, Webhook, Slack, Teams) |
| Incident Response |
Built-in |
Case management with an AI-assisted investigation workflow |
Subprocessors and hosting
CSIRT-Pro runs on a domestic managed-cloud provider, with a separate authentication provider for identity. Customer data and analytics stay within the domestic region. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
8. Integration Security
| Item |
Status |
Details |
| Integration Permissions |
Explicit |
Each integration declares the permissions it needs; user approval is required |
| Permission Types |
Granular |
log, case, playbook, pipeline, load_dashboard, asset |
| SharedAccess Controls |
Fine-grained |
Filtering via permission_query; read/write/admin levels |
| Third-Party Data Isolation |
Enforced |
Integration data flows through the same multi-tenant isolation controls |
| API Key Lifecycle |
Managed |
Create, view, and revoke keys; the key value is shown only at creation time |
9. Threat Intelligence Security
| Item |
Status |
Details |
| CVE Database |
Integrated |
Vulnerability search by product, CVE ID, and version comparison |
| IOC Search |
Integrated |
IP, domain, URL, MD5, SHA1, SHA256 indicator search |
| Threat-feed collection |
Supported |
Automated threat-feed collection and updates |
| KEV Filtering |
Available |
Known Exploited Vulnerabilities filter for prioritization |
| Threat Feed Updates |
Automated |
Continuous ingestion from connected threat-intelligence sources |
10. Operational Security
| Item |
Status |
Details |
| Environment Variable Security |
Encrypted |
Server-side encryption; UI masking; per-playbook scoping |
| Credential Rotation |
Supported |
API keys can be revoked and regenerated; environment variables can be updated |
| User Invitation Flow |
Controlled |
Email-based invitation with token-based acceptance |
| Organization Offboarding |
Supported |
User deletion and API key revocation |
| Cross-Organization Chat |
Secured |
Organization-to-organization messaging with file sharing; access controlled |
| File Sharing Controls |
Implemented |
Chat files are organization-scoped with metadata tracking |
Summary
CSIRT-Pro applies defense-in-depth controls across authentication, data protection, network security, auditing, and compliance.
The platform targets enterprise environments that need strict security governance while keeping SOC and CSIRT teams productive.
For API security specifics, see the API Reference.
For multi-tenant data sharing controls, see the Integrations documentation.