{"slug": "show-hn-eatheria-self-hosted-appsec-platform-with-ai-false-positive-filtering", "title": "Show HN: Eatheria – Self-hosted AppSec platform with AI false-positive filtering", "summary": "Eatheria, a self-hosted application security platform introduced on Hacker News, claims to be the first cybersecurity framework with seven specialized AI agent teams operating in parallel with isolated contexts, enabling autonomous penetration testing and false-positive filtering. The platform, developed by ConcordIA / TITAN, orchestrates RedTeam, BlueTeam, PurpleTeam, GreenTeam, WhiteTeam, YellowTeam, and OrangeTeam to execute full security operations, including reconnaissance, vulnerability analysis, exploitation, and reporting, with support for multiple languages and automatic task assignment.", "body_md": "**The first cybersecurity framework with 7 specialized AI agent teams working in parallel with isolated contexts**\n\n[Full Operation](#-full-operation-mode) •\n[Features](#-features) •\n[Teams](#-teams) •\n[Installation](#-installation) •\n[Usage](#-usage) •\n[Reports](#-reports)\n\n**Security Team by ConcordIA / TITAN** is a revolutionary framework that orchestrates **7 specialized AI security teams**. Each team operates with its own isolated context, but they can communicate and collaborate in real-time to execute complex security operations.\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                   🛡️ SECURITY TEAM by ConcordIA / TITAN                     │\n├─────────────────────────────────────────────────────────────────────────────┤\n│                                                                             │\n│   🔴 RedTeam    🔵 BlueTeam    🟣 PurpleTeam    🟢 GreenTeam               │\n│   ═══════════   ═══════════    ═════════════    ═══════════                │\n│   Pentesting    Detection      Validation       DevSecOps                  │\n│   Exploitation  Response       Simulation       SAST/DAST                  │\n│   Recon         Forensics      Gap Analysis     Container Sec              │\n│                                                                             │\n│   ⚪ WhiteTeam    🟡 YellowTeam    🟠 OrangeTeam                           │\n│   ═══════════     ═════════════    ═════════════                           │\n│   Compliance      Architecture     Awareness                               │\n│   Risk Mgmt       Threat Model     Phishing Sim                            │\n│   Audit           Zero Trust       Training                                │\n│                                                                             │\n├─────────────────────────────────────────────────────────────────────────────┤\n│  ✅ Isolated Contexts  ✅ Inter-Team Communication  ✅ Unified Reports      │\n└─────────────────────────────────────────────────────────────────────────────┘\n```\n\n**The most powerful feature:** The AI takes full control and executes complete security operations autonomously.\n\n| Language | Triggers |\n|---|---|\nEnglish |\n\"Full operation against [target]\", \"Pentest [target]\", \"Hack [target]\", \"Attack [target]\", \"Pwn [target]\", \"Red team [target]\", \"Penetration test [target]\" |\nSpanish |\n\"Full operation contra [target]\", \"Pentest de [target]\", \"Hackea [target]\", \"Ataca [target]\" |\nPortuguese |\n\"Pentest em [target]\", \"Ataque [target]\" |\nFrench |\n\"Test d'intrusion sur [target]\" |\nGerman |\n\"Penetrationstest auf [target]\" |\n\n```\nUser: \"Pentest example.com\"\n\n🤖 AI: Taking full control...\n\n═══ PHASE 1: RECONNAISSANCE ═══\n🔴 [RedTeam] Running reconnaissance...\n> nmap -sV -sC example.com\n> subfinder -d example.com\n> nuclei -u example.com\n[+] 3 subdomains found\n[+] Ports: 22, 80, 443, 3306\n\n═══ PHASE 2: VULNERABILITY ANALYSIS ═══\n🔴 [RedTeam] Scanning for vulnerabilities...\n[CRITICAL] SQLi found at /api/users?id=\n\n═══ PHASE 3: EXPLOITATION ═══\n🔴 [RedTeam] Exploiting SQLi...\n> sqlmap -u \"example.com/api/users?id=1\" --dump\n[+] Database dumped: 1,547 users\n\n═══ PHASE 4: DEFENSIVE ANALYSIS ═══\n🔵 [BlueTeam] Analyzing detections...\n[!] WAF did not block the attack\n[!] No alerts in logs\n\n═══ PHASE 5: VALIDATION ═══\n🟣 [PurpleTeam] Mapping to MITRE ATT&CK...\n- T1190: Exploit Public-Facing Application\n- T1059: Command Injection\n\n═══ PHASE 6: REPORT ═══\n📊 Generating mega report...\n[+] Report: reports/example-com-20240504/\n\n✅ OPERATION COMPLETED\n```\n\n| Situation | AI Decision |\n|---|---|\n| Port 80/443 open | → Full web scan |\n| SQLi detected | → Immediate exploitation |\n| Access obtained | → Post-exploitation |\n| WAF detected | → Bypass techniques |\n| No web vulns | → Pivot to other vectors |\n\n**7 specialized teams** working simultaneously**Completely isolated contexts** per project and team**Secure communication** between teams via`secteam share`\n\n**Intelligent orchestration** that assigns tasks to the right team**FULL OPERATION MODE**- AI executes everything automatically\n\n- Automated reconnaissance (subdomains, ports, services)\n- Vulnerability exploitation (web, network, API)\n- Post-exploitation and lateral movement\n- Payload generation and bypasses\n\n- Real-time threat detection\n- Forensic incident analysis\n- Proactive threat hunting\n- SIEM/IDS/IPS integration\n\n- MITRE ATT&CK attack simulation\n- Detection validation\n- Automated gap analysis\n- Purple Team exercises\n\n**Findings by team** with severity and evidence**CVEs and CWEs** identified**Exploits and payloads** used**Access obtained** and credentials**Exposed secrets** found**Remediation recommendations****Activity timeline**\n\n|\n|\n|\n|\n|\n|\n|\n|\n|\n|\n|\n\n- Linux (Kali Linux recommended)\n- Python 3.8+\n- Docker & Docker Compose\n- Git\n\n```\n# Clone the repository\ngit clone https://github.com/MartinCrespoC/Security-Team---Workspace-.git\ncd Security-Team---Workspace-\n\n# Full installation (requires sudo)\nsudo ./install.sh --full\n\n# Or interactive installation\nsudo ./install.sh\n```\n\n**IMPORTANT:** After installation, configure the required `.env`\n\nfiles:\n\n```\n# Copy configuration templates\ncp RedTeam/.env.example RedTeam/.env\ncp BlueTeam/.env.example BlueTeam/.env\ncp OrangeTeam/.env.example OrangeTeam/.env\n\n# Edit with your API keys and configurations\nnano RedTeam/.env\n```\n\n**Common environment variables:**\n\n| Variable | Description | Teams |\n|---|---|---|\n`SHODAN_API_KEY` |\nShodan API key | RedTeam |\n`VIRUSTOTAL_API_KEY` |\nVirusTotal API key | BlueTeam |\n`SLACK_WEBHOOK` |\nWebhook for notifications | All |\n`SMTP_SERVER` |\nSMTP server for phishing | OrangeTeam |\n\n```\n# View workspace status\nsecteam status\n\n# Create new project with isolated contexts\nsecteam new client-project-xyz\n\n# Activate team context\nsecteam red      # 🔴 Red Team\nsecteam blue     # 🔵 Blue Team\nsecteam purple   # 🟣 Purple Team\nsecteam green    # 🟢 Green Team\nsecteam white    # ⚪ White Team\nsecteam yellow   # 🟡 Yellow Team\nsecteam orange   # 🟠 Orange Team\n\n# Share findings between teams\nsecteam share BlueTeam vulnerability-report.md\n\n# Generate mega report\nsecteam report client-project-xyz\n\n# List projects\nsecteam list\n# 1. Create project\nsecteam new operation-aurora\n\n# 2. RedTeam: Reconnaissance and exploitation\nsecteam red\n# AI will execute: nmap, nuclei, sqlmap, etc.\n\n# 3. BlueTeam: Analyze detections\nsecteam blue\n# AI will analyze logs and generated alerts\n\n# 4. PurpleTeam: Validate gaps\nsecteam purple\n# AI will map to MITRE ATT&CK\n\n# 5. Generate mega report\nsecteam report operation-aurora --full\n```\n\nThe framework generates **Mega Reports** with all operation information:\n\n```\n📁 reports/\n└── 📁 operation-aurora-20240504/\n    ├── 📄 EXECUTIVE_SUMMARY.md\n    ├── 📄 FULL_REPORT.md\n    ├── 📁 findings/\n    │   ├── 📄 critical.md\n    │   ├── 📄 high.md\n    │   ├── 📄 medium.md\n    │   └── 📄 low.md\n    ├── 📁 evidence/\n    │   ├── 📁 screenshots/\n    │   ├── 📁 logs/\n    │   └── 📁 payloads/\n    ├── 📁 exploits/\n    │   ├── 📄 CVE-2024-XXXX.md\n    │   └── 📄 custom-exploits.md\n    ├── 📁 credentials/\n    │   ├── 📄 hashes.txt\n    │   ├── 📄 cracked.txt\n    │   └── 📄 secrets.md\n    └── 📄 REMEDIATION.md\n```\n\n| Section | Content |\n|---|---|\nExecutive Summary |\nHigh-level summary for executives |\nFindings |\nVulnerabilities by severity (Critical/High/Medium/Low) |\nCVEs Identified |\nList of CVEs with description and CVSS |\nCWEs Mapped |\nWeaknesses categorized by CWE |\nExploits Used |\nCode and payloads used |\nAccess Obtained |\nCompromised systems and access level |\nCredentials |\nHashes, cracked passwords, API keys |\nExposed Secrets |\nTokens, keys, certificates found |\nTimeline |\nOperation chronology |\nResponsible Team |\nWhich team discovered each finding |\nRemediation |\nRecommended fixes with priority |\n\nThis workspace works with **any AI-powered IDE**:\n\n| IDE/Assistant | Configuration File | Status |\n|---|---|---|\nWindsurf |\n`.windsurfrules` |\n✅ |\nCursor |\n`.cursorrules` |\n✅ |\nGitHub Copilot |\n`.github/copilot-instructions.md` |\n✅ |\nCline/Claude Dev |\n`.clinerules` |\n✅ |\nGemini |\n`.gemini` |\n✅ |\nClaude |\n`CLAUDE.md` |\n✅ |\n\nSimply open the workspace in your IDE and request:\n\n```\n\"Pentest example.com\"\n\"Analyze these logs for malicious activity\"\n\"Scan the code for vulnerabilities\"\n\"Create a threat model for the application\"\n\"Generate an ISO 27001 compliance report\"\n```\n\nThe AI will automatically identify which team(s) should act and execute the appropriate tools.\n\n```\nSecurity-Team---Workspace-/\n│\n├── 🔴 RedTeam/                    # Offensive tools\n│   ├── tools/\n│   ├── scripts/\n│   ├── wordlists/\n│   └── .env.example\n│\n├── 🔵 BlueTeam/                   # Defensive tools\n│   ├── rules/\n│   ├── playbooks/\n│   ├── iocs/\n│   └── .env.example\n│\n├── 🟣 PurpleTeam/                 # Validation\n│   ├── atomic-tests/\n│   ├── detections/\n│   └── mappings/\n│\n├── 🟢 GreenTeam/                  # DevSecOps\n│   ├── scanners/\n│   ├── policies/\n│   └── pipelines/\n│\n├── ⚪ WhiteTeam/                  # GRC\n│   ├── frameworks/\n│   ├── policies/\n│   ├── audits/\n│   └── templates/\n│\n├── 🟡 YellowTeam/                 # Architecture\n│   ├── threat-models/\n│   ├── architectures/\n│   └── requirements/\n│\n├── 🟠 OrangeTeam/                 # Awareness\n│   ├── campaigns/\n│   ├── training/\n│   └── templates/\n│\n├── 📁 .contexts/                  # Context configuration\n│   └── config.json\n│\n├── 📁 .projects/                  # Projects (isolated contexts)\n│\n├── 📁 .shared/                    # Shared findings\n│\n├── 📁 .windsurf/workflows/        # Automation workflows\n│\n├── 📁 reports/                    # Generated mega reports\n│\n├── 🔧 secteam                     # CLI Orchestrator\n├── 🔧 install.sh                  # Unified installer\n├── 📄 .windsurfrules              # Windsurf config\n├── 📄 .cursorrules                # Cursor config\n├── 📄 .clinerules                 # Cline config\n├── 📄 .gemini                     # Gemini config\n├── 📄 CLAUDE.md                   # Claude config\n├── 📄 LICENSE                     # License\n└── 📄 README.md                   # This file\n```\n\nThis framework is designed **exclusively for authorized use** in:\n\n- Authorized penetration testing\n- Contracted security assessments\n- Ethical security research\n- Lab environments and CTFs\n\n**Unauthorized use of these tools is illegal and strictly prohibited.**\n\nThis project is under the **Security Research License**. See [LICENSE](/MartinCrespoC/Security-Team---Workspace-/blob/main/LICENSE) for details.\n\nContributions are welcome. Please read the contribution guidelines before submitting a PR.\n\n**Martin Crespo**\n\n**🛡️ Break Everything. Protect Everything. Report Everything. 🛡️**", "url": "https://wpnews.pro/news/show-hn-eatheria-self-hosted-appsec-platform-with-ai-false-positive-filtering", "canonical_source": "https://github.com/MartinCrespoC/Security-Team---Workspace-", "published_at": "2026-09-01 04:21:15+00:00", "updated_at": "2026-09-01 04:52:16.693329+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-products", "ai-tools"], "entities": ["Eatheria", "ConcordIA", "TITAN"], "alternates": {"html": "https://wpnews.pro/news/show-hn-eatheria-self-hosted-appsec-platform-with-ai-false-positive-filtering", "markdown": "https://wpnews.pro/news/show-hn-eatheria-self-hosted-appsec-platform-with-ai-false-positive-filtering.md", "text": "https://wpnews.pro/news/show-hn-eatheria-self-hosted-appsec-platform-with-ai-false-positive-filtering.txt", "jsonld": "https://wpnews.pro/news/show-hn-eatheria-self-hosted-appsec-platform-with-ai-false-positive-filtering.jsonld"}}