# Show HN: Eatheria – Self-hosted AppSec platform with AI false-positive filtering > Source: > Published: 2026-09-01 04:21:15+00:00 **The first cybersecurity framework with 7 specialized AI agent teams working in parallel with isolated contexts** [Full Operation](#-full-operation-mode) • [Features](#-features) • [Teams](#-teams) • [Installation](#-installation) • [Usage](#-usage) • [Reports](#-reports) **Security Team by ConcordIA / TITAN** is a revolutionary framework that orchestrates **7 specialized AI security teams**. Each team operates with its own isolated context, but they can communicate and collaborate in real-time to execute complex security operations. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ 🛡️ SECURITY TEAM by ConcordIA / TITAN │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ 🔴 RedTeam 🔵 BlueTeam 🟣 PurpleTeam 🟢 GreenTeam │ │ ═══════════ ═══════════ ═════════════ ═══════════ │ │ Pentesting Detection Validation DevSecOps │ │ Exploitation Response Simulation SAST/DAST │ │ Recon Forensics Gap Analysis Container Sec │ │ │ │ ⚪ WhiteTeam 🟡 YellowTeam 🟠 OrangeTeam │ │ ═══════════ ═════════════ ═════════════ │ │ Compliance Architecture Awareness │ │ Risk Mgmt Threat Model Phishing Sim │ │ Audit Zero Trust Training │ │ │ ├─────────────────────────────────────────────────────────────────────────────┤ │ ✅ Isolated Contexts ✅ Inter-Team Communication ✅ Unified Reports │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **The most powerful feature:** The AI takes full control and executes complete security operations autonomously. | Language | Triggers | |---|---| English | "Full operation against [target]", "Pentest [target]", "Hack [target]", "Attack [target]", "Pwn [target]", "Red team [target]", "Penetration test [target]" | Spanish | "Full operation contra [target]", "Pentest de [target]", "Hackea [target]", "Ataca [target]" | Portuguese | "Pentest em [target]", "Ataque [target]" | French | "Test d'intrusion sur [target]" | German | "Penetrationstest auf [target]" | ``` User: "Pentest example.com" 🤖 AI: Taking full control... ═══ PHASE 1: RECONNAISSANCE ═══ 🔴 [RedTeam] Running reconnaissance... > nmap -sV -sC example.com > subfinder -d example.com > nuclei -u example.com [+] 3 subdomains found [+] Ports: 22, 80, 443, 3306 ═══ PHASE 2: VULNERABILITY ANALYSIS ═══ 🔴 [RedTeam] Scanning for vulnerabilities... [CRITICAL] SQLi found at /api/users?id= ═══ PHASE 3: EXPLOITATION ═══ 🔴 [RedTeam] Exploiting SQLi... > sqlmap -u "example.com/api/users?id=1" --dump [+] Database dumped: 1,547 users ═══ PHASE 4: DEFENSIVE ANALYSIS ═══ 🔵 [BlueTeam] Analyzing detections... [!] WAF did not block the attack [!] No alerts in logs ═══ PHASE 5: VALIDATION ═══ 🟣 [PurpleTeam] Mapping to MITRE ATT&CK... - T1190: Exploit Public-Facing Application - T1059: Command Injection ═══ PHASE 6: REPORT ═══ 📊 Generating mega report... [+] Report: reports/example-com-20240504/ ✅ OPERATION COMPLETED ``` | Situation | AI Decision | |---|---| | Port 80/443 open | → Full web scan | | SQLi detected | → Immediate exploitation | | Access obtained | → Post-exploitation | | WAF detected | → Bypass techniques | | No web vulns | → Pivot to other vectors | **7 specialized teams** working simultaneously**Completely isolated contexts** per project and team**Secure communication** between teams via`secteam share` **Intelligent orchestration** that assigns tasks to the right team**FULL OPERATION MODE**- AI executes everything automatically - Automated reconnaissance (subdomains, ports, services) - Vulnerability exploitation (web, network, API) - Post-exploitation and lateral movement - Payload generation and bypasses - Real-time threat detection - Forensic incident analysis - Proactive threat hunting - SIEM/IDS/IPS integration - MITRE ATT&CK attack simulation - Detection validation - Automated gap analysis - Purple Team exercises **Findings by team** with severity and evidence**CVEs and CWEs** identified**Exploits and payloads** used**Access obtained** and credentials**Exposed secrets** found**Remediation recommendations****Activity timeline** | | | | | | | | | | | - Linux (Kali Linux recommended) - Python 3.8+ - Docker & Docker Compose - Git ``` # Clone the repository git clone https://github.com/MartinCrespoC/Security-Team---Workspace-.git cd Security-Team---Workspace- # Full installation (requires sudo) sudo ./install.sh --full # Or interactive installation sudo ./install.sh ``` **IMPORTANT:** After installation, configure the required `.env` files: ``` # Copy configuration templates cp RedTeam/.env.example RedTeam/.env cp BlueTeam/.env.example BlueTeam/.env cp OrangeTeam/.env.example OrangeTeam/.env # Edit with your API keys and configurations nano RedTeam/.env ``` **Common environment variables:** | Variable | Description | Teams | |---|---|---| `SHODAN_API_KEY` | Shodan API key | RedTeam | `VIRUSTOTAL_API_KEY` | VirusTotal API key | BlueTeam | `SLACK_WEBHOOK` | Webhook for notifications | All | `SMTP_SERVER` | SMTP server for phishing | OrangeTeam | ``` # View workspace status secteam status # Create new project with isolated contexts secteam new client-project-xyz # Activate team context secteam red # 🔴 Red Team secteam blue # 🔵 Blue Team secteam purple # 🟣 Purple Team secteam green # 🟢 Green Team secteam white # ⚪ White Team secteam yellow # 🟡 Yellow Team secteam orange # 🟠 Orange Team # Share findings between teams secteam share BlueTeam vulnerability-report.md # Generate mega report secteam report client-project-xyz # List projects secteam list # 1. Create project secteam new operation-aurora # 2. RedTeam: Reconnaissance and exploitation secteam red # AI will execute: nmap, nuclei, sqlmap, etc. # 3. BlueTeam: Analyze detections secteam blue # AI will analyze logs and generated alerts # 4. PurpleTeam: Validate gaps secteam purple # AI will map to MITRE ATT&CK # 5. Generate mega report secteam report operation-aurora --full ``` The framework generates **Mega Reports** with all operation information: ``` 📁 reports/ └── 📁 operation-aurora-20240504/ ├── 📄 EXECUTIVE_SUMMARY.md ├── 📄 FULL_REPORT.md ├── 📁 findings/ │ ├── 📄 critical.md │ ├── 📄 high.md │ ├── 📄 medium.md │ └── 📄 low.md ├── 📁 evidence/ │ ├── 📁 screenshots/ │ ├── 📁 logs/ │ └── 📁 payloads/ ├── 📁 exploits/ │ ├── 📄 CVE-2024-XXXX.md │ └── 📄 custom-exploits.md ├── 📁 credentials/ │ ├── 📄 hashes.txt │ ├── 📄 cracked.txt │ └── 📄 secrets.md └── 📄 REMEDIATION.md ``` | Section | Content | |---|---| Executive Summary | High-level summary for executives | Findings | Vulnerabilities by severity (Critical/High/Medium/Low) | CVEs Identified | List of CVEs with description and CVSS | CWEs Mapped | Weaknesses categorized by CWE | Exploits Used | Code and payloads used | Access Obtained | Compromised systems and access level | Credentials | Hashes, cracked passwords, API keys | Exposed Secrets | Tokens, keys, certificates found | Timeline | Operation chronology | Responsible Team | Which team discovered each finding | Remediation | Recommended fixes with priority | This workspace works with **any AI-powered IDE**: | IDE/Assistant | Configuration File | Status | |---|---|---| Windsurf | `.windsurfrules` | ✅ | Cursor | `.cursorrules` | ✅ | GitHub Copilot | `.github/copilot-instructions.md` | ✅ | Cline/Claude Dev | `.clinerules` | ✅ | Gemini | `.gemini` | ✅ | Claude | `CLAUDE.md` | ✅ | Simply open the workspace in your IDE and request: ``` "Pentest example.com" "Analyze these logs for malicious activity" "Scan the code for vulnerabilities" "Create a threat model for the application" "Generate an ISO 27001 compliance report" ``` The AI will automatically identify which team(s) should act and execute the appropriate tools. ``` Security-Team---Workspace-/ │ ├── 🔴 RedTeam/ # Offensive tools │ ├── tools/ │ ├── scripts/ │ ├── wordlists/ │ └── .env.example │ ├── 🔵 BlueTeam/ # Defensive tools │ ├── rules/ │ ├── playbooks/ │ ├── iocs/ │ └── .env.example │ ├── 🟣 PurpleTeam/ # Validation │ ├── atomic-tests/ │ ├── detections/ │ └── mappings/ │ ├── 🟢 GreenTeam/ # DevSecOps │ ├── scanners/ │ ├── policies/ │ └── pipelines/ │ ├── ⚪ WhiteTeam/ # GRC │ ├── frameworks/ │ ├── policies/ │ ├── audits/ │ └── templates/ │ ├── 🟡 YellowTeam/ # Architecture │ ├── threat-models/ │ ├── architectures/ │ └── requirements/ │ ├── 🟠 OrangeTeam/ # Awareness │ ├── campaigns/ │ ├── training/ │ └── templates/ │ ├── 📁 .contexts/ # Context configuration │ └── config.json │ ├── 📁 .projects/ # Projects (isolated contexts) │ ├── 📁 .shared/ # Shared findings │ ├── 📁 .windsurf/workflows/ # Automation workflows │ ├── 📁 reports/ # Generated mega reports │ ├── 🔧 secteam # CLI Orchestrator ├── 🔧 install.sh # Unified installer ├── 📄 .windsurfrules # Windsurf config ├── 📄 .cursorrules # Cursor config ├── 📄 .clinerules # Cline config ├── 📄 .gemini # Gemini config ├── 📄 CLAUDE.md # Claude config ├── 📄 LICENSE # License └── 📄 README.md # This file ``` This framework is designed **exclusively for authorized use** in: - Authorized penetration testing - Contracted security assessments - Ethical security research - Lab environments and CTFs **Unauthorized use of these tools is illegal and strictly prohibited.** This project is under the **Security Research License**. See [LICENSE](/MartinCrespoC/Security-Team---Workspace-/blob/main/LICENSE) for details. Contributions are welcome. Please read the contribution guidelines before submitting a PR. **Martin Crespo** **🛡️ Break Everything. Protect Everything. Report Everything. 🛡️**