Sample Environment Context Comparison

Use this sample when you need to demonstrate why Kyberis asks for environment context. The same threat can require immediate validation in one environment and only monitoring in another.

Scenario

Two teams ask about current Exchange exploitation activity:

A US healthcare company runs Microsoft Exchange with public OWA exposure.
A SaaS company runs Linux workloads, Kubernetes, and public APIs, but has no Exchange footprint.

Without environment-aware ranking, both teams might receive the same alert. With Kyberis, the ranking response explains why the signal matters or why it was lowered.

Healthcare environment

curl -sS -X POST "$KYBERIS_BASE_URL/v2/prioritize" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Prioritize Exchange-related activity for a healthcare environment.",
      "requested_outcome": "Ranked signals with environment match reasons and next actions.",
      "workflow_stage": "assessment",
      "run_id": "run-context-comparison",
      "step_id": "prioritize-healthcare"
    },
    "environment": {
      "products": ["Microsoft Exchange", "Okta"],
      "vendors": ["Microsoft", "Okta"],
      "capabilities": ["federated_identity"],
      "industry": "healthcare",
      "geography": ["US"],
      "external_exposure": ["owa", "vpn"]
    },
    "expected_categories": ["vulnerability", "identity_abuse"],
    "time_window_days": 14,
    "max_items": 5
  }' | jq .

Representative excerpt:

{
  "request_id": "req_sample_context_healthcare",
  "items": [
    {
      "signal_id": "sig--cve--sample-exchange",
      "title": "Exchange exploitation activity against OWA-exposed environments",
      "category": "vulnerability",
      "priority": "high",
      "priority_score": 0.88,
      "confidence_score": 0.81,
      "activity_level": "active",
      "novelty_score": 0.62,
      "freshness_score": 0.9,
      "environment_match_reasons": [
        "direct_product_match: Microsoft Exchange",
        "external_exposure_match: owa",
        "industry_match: healthcare"
      ],
      "suppression_reasons": [],
      "supporting_evidence": [
        {
          "evidence_id": "report--sample-exchange-activity",
          "evidence_type": "campaign_report",
          "source": "Vendor advisory",
          "published_at": "2026-07-10T08:00:00Z"
        }
      ],
      "what_changed": ["new_exploitation_evidence"],
      "recommended_action_type": "validate_exposure",
      "recommended_action_summary": "Confirm public OWA exposure and affected Exchange versions before remediation."
    }
  ]
}

Linux-only SaaS environment

curl -sS -X POST "$KYBERIS_BASE_URL/v2/prioritize" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Prioritize Exchange-related activity for a Linux SaaS environment.",
      "requested_outcome": "Ranked signals with suppression reasons when relevance is weak.",
      "workflow_stage": "assessment",
      "run_id": "run-context-comparison",
      "step_id": "prioritize-saas"
    },
    "environment": {
      "products": ["Kubernetes", "PostgreSQL", "NGINX"],
      "vendors": ["Linux Foundation"],
      "capabilities": ["containerized_workloads", "public_api_surface"],
      "industry": "technology",
      "geography": ["US"],
      "external_exposure": ["public_api"]
    },
    "expected_categories": ["vulnerability", "cloud_control_plane"],
    "time_window_days": 14,
    "max_items": 5
  }' | jq .

Representative excerpt:

{
  "request_id": "req_sample_context_saas",
  "items": [
    {
      "signal_id": "sig--cve--sample-exchange",
      "title": "Exchange exploitation activity against OWA-exposed environments",
      "category": "vulnerability",
      "priority": "low",
      "priority_score": 0.24,
      "confidence_score": 0.81,
      "activity_level": "active",
      "novelty_score": 0.62,
      "freshness_score": 0.9,
      "environment_match_reasons": [],
      "suppression_reasons": [
        "platform_mismatch: Microsoft Exchange is not present in the provided environment",
        "exposure_mismatch: owa is not listed as externally exposed"
      ],
      "supporting_evidence": [
        {
          "evidence_id": "report--sample-exchange-activity",
          "evidence_type": "campaign_report",
          "source": "Vendor advisory",
          "published_at": "2026-07-10T08:00:00Z"
        }
      ],
      "what_changed": ["new_exploitation_evidence"],
      "recommended_action_type": "monitor",
      "recommended_action_summary": "Monitor for scope changes instead of interrupting current remediation work."
    }
  ]
}

Final answer example

Recommendation: Validate Exchange exposure immediately for the healthcare environment. Monitor the Exchange signal for the Linux-only SaaS environment unless asset inventory changes. Why now: Kyberis ranked the same activity differently because the first environment includes Microsoft Exchange and public OWA exposure, while the second does not. Confidence: High confidence that the signal is active. Environment-specific priority depends on the supplied asset and exposure context. Supporting evidence: report--sample-exchange-activity. Request IDs: req_sample_context_healthcare, req_sample_context_saas. Next actions: Confirm the Exchange asset inventory, hydrate the supporting evidence if the recommendation will drive incident response, and validate the top one to three ranked items before assigning remediation work.

Getting started

Install Kyberis

Threat investigations

Sample investigations

Interpret responses

Sample Environment Context Comparison

Scenario

Healthcare environment

Linux-only SaaS environment

Final answer example

​Scenario

​Healthcare environment

​Linux-only SaaS environment

​Final answer example

Scenario

Healthcare environment

Linux-only SaaS environment

Final answer example