> ## Documentation Index
> Fetch the complete documentation index at: https://developer.kyberis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sample Environment Context Comparison

> Show how the same threat can rank differently when environment context changes.

Use this sample when you need to demonstrate why Kyberis asks for environment context. The same threat can require immediate validation in one environment and only monitoring in another.

## Scenario

Two teams ask about current Exchange exploitation activity:

* A US healthcare company runs Microsoft Exchange with public OWA exposure.
* A SaaS company runs Linux workloads, Kubernetes, and public APIs, but has no Exchange footprint.

Without environment-aware ranking, both teams might receive the same alert. With Kyberis, the ranking response explains why the signal matters or why it was lowered.

## Healthcare environment

```bash theme={null}
curl -sS -X POST "$KYBERIS_BASE_URL/v2/prioritize" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Prioritize Exchange-related activity for a healthcare environment.",
      "requested_outcome": "Ranked signals with environment match reasons and next actions.",
      "workflow_stage": "assessment",
      "run_id": "run-context-comparison",
      "step_id": "prioritize-healthcare"
    },
    "environment": {
      "products": ["Microsoft Exchange", "Okta"],
      "vendors": ["Microsoft", "Okta"],
      "capabilities": ["federated_identity"],
      "industry": "healthcare",
      "geography": ["US"],
      "external_exposure": ["owa", "vpn"]
    },
    "expected_categories": ["vulnerability", "identity_abuse"],
    "time_window_days": 14,
    "max_items": 5
  }' | jq .
```

Representative excerpt:

```json theme={null}
{
  "request_id": "req_sample_context_healthcare",
  "items": [
    {
      "signal_id": "sig--cve--sample-exchange",
      "title": "Exchange exploitation activity against OWA-exposed environments",
      "category": "vulnerability",
      "priority": "high",
      "priority_score": 0.88,
      "confidence_score": 0.81,
      "activity_level": "active",
      "novelty_score": 0.62,
      "freshness_score": 0.9,
      "environment_match_reasons": [
        "direct_product_match: Microsoft Exchange",
        "external_exposure_match: owa",
        "industry_match: healthcare"
      ],
      "suppression_reasons": [],
      "supporting_evidence": [
        {
          "evidence_id": "report--sample-exchange-activity",
          "evidence_type": "campaign_report",
          "source": "Vendor advisory",
          "published_at": "2026-07-10T08:00:00Z"
        }
      ],
      "what_changed": ["new_exploitation_evidence"],
      "recommended_action_type": "validate_exposure",
      "recommended_action_summary": "Confirm public OWA exposure and affected Exchange versions before remediation."
    }
  ]
}
```

## Linux-only SaaS environment

```bash theme={null}
curl -sS -X POST "$KYBERIS_BASE_URL/v2/prioritize" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Prioritize Exchange-related activity for a Linux SaaS environment.",
      "requested_outcome": "Ranked signals with suppression reasons when relevance is weak.",
      "workflow_stage": "assessment",
      "run_id": "run-context-comparison",
      "step_id": "prioritize-saas"
    },
    "environment": {
      "products": ["Kubernetes", "PostgreSQL", "NGINX"],
      "vendors": ["Linux Foundation"],
      "capabilities": ["containerized_workloads", "public_api_surface"],
      "industry": "technology",
      "geography": ["US"],
      "external_exposure": ["public_api"]
    },
    "expected_categories": ["vulnerability", "cloud_control_plane"],
    "time_window_days": 14,
    "max_items": 5
  }' | jq .
```

Representative excerpt:

```json theme={null}
{
  "request_id": "req_sample_context_saas",
  "items": [
    {
      "signal_id": "sig--cve--sample-exchange",
      "title": "Exchange exploitation activity against OWA-exposed environments",
      "category": "vulnerability",
      "priority": "low",
      "priority_score": 0.24,
      "confidence_score": 0.81,
      "activity_level": "active",
      "novelty_score": 0.62,
      "freshness_score": 0.9,
      "environment_match_reasons": [],
      "suppression_reasons": [
        "platform_mismatch: Microsoft Exchange is not present in the provided environment",
        "exposure_mismatch: owa is not listed as externally exposed"
      ],
      "supporting_evidence": [
        {
          "evidence_id": "report--sample-exchange-activity",
          "evidence_type": "campaign_report",
          "source": "Vendor advisory",
          "published_at": "2026-07-10T08:00:00Z"
        }
      ],
      "what_changed": ["new_exploitation_evidence"],
      "recommended_action_type": "monitor",
      "recommended_action_summary": "Monitor for scope changes instead of interrupting current remediation work."
    }
  ]
}
```

## Final answer example

**Recommendation:** Validate Exchange exposure immediately for the healthcare environment. Monitor the Exchange signal for the Linux-only SaaS environment unless asset inventory changes.

**Why now:** Kyberis ranked the same activity differently because the first environment includes Microsoft Exchange and public OWA exposure, while the second does not.

**Confidence:** High confidence that the signal is active. Environment-specific priority depends on the supplied asset and exposure context.

**Supporting evidence:** `report--sample-exchange-activity`. Request IDs: `req_sample_context_healthcare`, `req_sample_context_saas`.

**Next actions:** Confirm the Exchange asset inventory, hydrate the supporting evidence if the recommendation will drive incident response, and validate the top one to three ranked items before assigning remediation work.