Sample Environment Prioritization

Use this sample when a user asks what deserves attention first for a specific environment. Start with /v2/prioritize, then investigate the top ranked items instead of deep-diving every result. This showcases Kyberis value: normalized signals, deterministic ranking, visible environment-match reasons, evidence, and an ordered action plan.

Scenario

A customer asks:

What should a US healthcare company running Microsoft Exchange, Okta, Kubernetes, and public APIs care about this week?

REST flow

1. Rank items

curl -sS -X POST "$KYBERIS_BASE_URL/v2/prioritize" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Prioritize current threats for a healthcare environment.",
      "requested_outcome": "Ranked items with environment match reasons.",
      "workflow_stage": "assessment",
      "run_id": "run-prioritize-healthcare-sample",
      "step_id": "prioritize"
    },
    "environment": {
      "products": ["Microsoft Exchange", "Okta", "Kubernetes"],
      "vendors": ["Microsoft", "Okta"],
      "capabilities": ["federated_identity", "public_api_surface"],
      "cloud_providers": ["aws"],
      "hosting_model": "hybrid",
      "industry": "healthcare",
      "geography": ["US"],
      "external_exposure": ["vpn", "owa", "public_api"]
    },
    "time_window_days": 14,
    "max_items": 10
  }' | jq .

Representative response excerpt:

{
  "request_id": "req_sample_prioritize",
  "items": [
    {
      "signal_id": "sig--cve--sample-exchange",
      "title": "Exchange exploitation activity relevant to OWA exposure",
      "priority": "high",
      "priority_score": 0.88,
      "confidence_score": 0.81,
      "environment_match_reasons": ["direct_product_match: Microsoft Exchange", "external_exposure_match: owa", "industry_match: healthcare"],
      "suppression_reasons": [],
      "recommended_action_type": "validate_exposure",
      "supporting_evidence": [{"evidence_id": "report--sample-exchange-activity", "evidence_type": "campaign_report"}],
      "what_changed": ["new_exploitation_evidence"]
    },
    {
      "signal_id": "sig--identity-abuse--sample-phishing",
      "title": "Identity phishing activity relevant to federated identity",
      "priority": "medium",
      "priority_score": 0.71,
      "confidence_score": 0.76,
      "environment_match_reasons": ["direct_product_match: Okta", "capability_match: federated_identity"],
      "suppression_reasons": [],
      "supporting_evidence": [],
      "what_changed": ["recent_activity"]
    }
  ]
}

2. Validate a top item

Use the item subject, title, or evidence references to run focused evidence and relationships calls. For a CVE-like signal, use a CVE assessment. For an actor or IOC-like signal, use the matching assessment endpoint.

curl -sS -X POST "$KYBERIS_BASE_URL/v2/evidence" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Validate the top Exchange-related prioritized signal.",
      "requested_outcome": "Evidence supporting activity and environment relevance.",
      "workflow_stage": "evidence",
      "run_id": "run-prioritize-healthcare-sample",
      "step_id": "evidence-top-signal"
    },
    "query": "Exchange exploitation activity relevant to OWA exposure",
    "claim_type": "relevance_to_environment",
    "max_results": 5
  }' | jq .

Final answer example

Top action: Validate Exchange/OWA exposure first. Why now: Kyberis ranked the Exchange-related item highest because it matched Microsoft Exchange, OWA exposure, US healthcare context, and recent supporting evidence. Confidence: High for prioritization fit, medium-high for immediate action until exposure is confirmed. Supporting evidence: report--sample-exchange-activity. Request ID: req_sample_prioritize. Action plan:

Confirm whether public OWA is exposed and whether affected versions are present.
Review recent authentication, proxy, and endpoint telemetry for Exchange exploitation indicators.
Then evaluate identity phishing activity tied to federated identity and Okta.

Decision gates

Do not turn the entire ranked list into equal-priority work.
Validate the top one to three signals with evidence or relationships before recommending disruptive action.
Use suppression_reasons and caveats when a signal is lowered or confidence is partial.

Getting started

Install Kyberis

Threat investigations

Sample investigations

Interpret responses

Sample Environment Prioritization

Scenario

REST flow

1. Rank items

2. Validate a top item

Final answer example

Decision gates

​Scenario

​REST flow

​1. Rank items

​2. Validate a top item

​Final answer example

​Decision gates

Scenario

REST flow

1. Rank items

2. Validate a top item

Final answer example

Decision gates