Show HN: Eatheria – Self-hosted AppSec platform with AI false-positive filtering

Eatheria, a self-hosted application security platform introduced on Hacker News, claims to be the first cybersecurity framework with seven specialized AI agent teams operating in parallel with isolated contexts, enabling autonomous penetration testing and false-positive filtering. The platform, developed by ConcordIA / TITAN, orchestrates RedTeam, BlueTeam, PurpleTeam, GreenTeam, WhiteTeam, YellowTeam, and OrangeTeam to execute full security operations, including reconnaissance, vulnerability analysis, exploitation, and reporting, with support for multiple languages and automatic task assignment.

The first cybersecurity framework with 7 specialized AI agent teams working in parallel with isolated contexts Full Operation -full-operation-mode • Features -features • Teams -teams • Installation -installation • Usage -usage • Reports -reports Security Team by ConcordIA / TITAN is a revolutionary framework that orchestrates 7 specialized AI security teams . Each team operates with its own isolated context, but they can communicate and collaborate in real-time to execute complex security operations. ┌─────────────────────────────────────────────────────────────────────────────┐ │ 🛡️ SECURITY TEAM by ConcordIA / TITAN │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ 🔴 RedTeam 🔵 BlueTeam 🟣 PurpleTeam 🟢 GreenTeam │ │ ═══════════ ═══════════ ═════════════ ═══════════ │ │ Pentesting Detection Validation DevSecOps │ │ Exploitation Response Simulation SAST/DAST │ │ Recon Forensics Gap Analysis Container Sec │ │ │ │ ⚪ WhiteTeam 🟡 YellowTeam 🟠 OrangeTeam │ │ ═══════════ ═════════════ ═════════════ │ │ Compliance Architecture Awareness │ │ Risk Mgmt Threat Model Phishing Sim │ │ Audit Zero Trust Training │ │ │ ├─────────────────────────────────────────────────────────────────────────────┤ │ ✅ Isolated Contexts ✅ Inter-Team Communication ✅ Unified Reports │ └─────────────────────────────────────────────────────────────────────────────┘ The most powerful feature: The AI takes full control and executes complete security operations autonomously. | Language | Triggers | |---|---| English | "Full operation against target ", "Pentest target ", "Hack target ", "Attack target ", "Pwn target ", "Red team target ", "Penetration test target " | Spanish | "Full operation contra target ", "Pentest de target ", "Hackea target ", "Ataca target " | Portuguese | "Pentest em target ", "Ataque target " | French | "Test d'intrusion sur target " | German | "Penetrationstest auf target " | User: "Pentest example.com" 🤖 AI: Taking full control... ═══ PHASE 1: RECONNAISSANCE ═══ 🔴 RedTeam Running reconnaissance... nmap -sV -sC example.com subfinder -d example.com nuclei -u example.com + 3 subdomains found + Ports: 22, 80, 443, 3306 ═══ PHASE 2: VULNERABILITY ANALYSIS ═══ 🔴 RedTeam Scanning for vulnerabilities... CRITICAL SQLi found at /api/users?id= ═══ PHASE 3: EXPLOITATION ═══ 🔴 RedTeam Exploiting SQLi... sqlmap -u "example.com/api/users?id=1" --dump + Database dumped: 1,547 users ═══ PHASE 4: DEFENSIVE ANALYSIS ═══ 🔵 BlueTeam Analyzing detections... WAF did not block the attack No alerts in logs ═══ PHASE 5: VALIDATION ═══ 🟣 PurpleTeam Mapping to MITRE ATT&CK... - T1190: Exploit Public-Facing Application - T1059: Command Injection ═══ PHASE 6: REPORT ═══ 📊 Generating mega report... + Report: reports/example-com-20240504/ ✅ OPERATION COMPLETED | Situation | AI Decision | |---|---| | Port 80/443 open | → Full web scan | | SQLi detected | → Immediate exploitation | | Access obtained | → Post-exploitation | | WAF detected | → Bypass techniques | | No web vulns | → Pivot to other vectors | 7 specialized teams working simultaneously Completely isolated contexts per project and team Secure communication between teams via secteam share Intelligent orchestration that assigns tasks to the right team FULL OPERATION MODE - AI executes everything automatically - Automated reconnaissance subdomains, ports, services - Vulnerability exploitation web, network, API - Post-exploitation and lateral movement - Payload generation and bypasses - Real-time threat detection - Forensic incident analysis - Proactive threat hunting - SIEM/IDS/IPS integration - MITRE ATT&CK attack simulation - Detection validation - Automated gap analysis - Purple Team exercises Findings by team with severity and evidence CVEs and CWEs identified Exploits and payloads used Access obtained and credentials Exposed secrets found Remediation recommendations Activity timeline | | | | | | | | | | | - Linux Kali Linux recommended - Python 3.8+ - Docker & Docker Compose - Git Clone the repository git clone https://github.com/MartinCrespoC/Security-Team---Workspace-.git cd Security-Team---Workspace- Full installation requires sudo sudo ./install.sh --full Or interactive installation sudo ./install.sh IMPORTANT: After installation, configure the required .env files: Copy configuration templates cp RedTeam/.env.example RedTeam/.env cp BlueTeam/.env.example BlueTeam/.env cp OrangeTeam/.env.example OrangeTeam/.env Edit with your API keys and configurations nano RedTeam/.env Common environment variables: | Variable | Description | Teams | |---|---|---| SHODAN API KEY | Shodan API key | RedTeam | VIRUSTOTAL API KEY | VirusTotal API key | BlueTeam | SLACK WEBHOOK | Webhook for notifications | All | SMTP SERVER | SMTP server for phishing | OrangeTeam | View workspace status secteam status Create new project with isolated contexts secteam new client-project-xyz Activate team context secteam red 🔴 Red Team secteam blue 🔵 Blue Team secteam purple 🟣 Purple Team secteam green 🟢 Green Team secteam white ⚪ White Team secteam yellow 🟡 Yellow Team secteam orange 🟠 Orange Team Share findings between teams secteam share BlueTeam vulnerability-report.md Generate mega report secteam report client-project-xyz List projects secteam list 1. Create project secteam new operation-aurora 2. RedTeam: Reconnaissance and exploitation secteam red AI will execute: nmap, nuclei, sqlmap, etc. 3. BlueTeam: Analyze detections secteam blue AI will analyze logs and generated alerts 4. PurpleTeam: Validate gaps secteam purple AI will map to MITRE ATT&CK 5. Generate mega report secteam report operation-aurora --full The framework generates Mega Reports with all operation information: 📁 reports/ └── 📁 operation-aurora-20240504/ ├── 📄 EXECUTIVE SUMMARY.md ├── 📄 FULL REPORT.md ├── 📁 findings/ │ ├── 📄 critical.md │ ├── 📄 high.md │ ├── 📄 medium.md │ └── 📄 low.md ├── 📁 evidence/ │ ├── 📁 screenshots/ │ ├── 📁 logs/ │ └── 📁 payloads/ ├── 📁 exploits/ │ ├── 📄 CVE-2024-XXXX.md │ └── 📄 custom-exploits.md ├── 📁 credentials/ │ ├── 📄 hashes.txt │ ├── 📄 cracked.txt │ └── 📄 secrets.md └── 📄 REMEDIATION.md | Section | Content | |---|---| Executive Summary | High-level summary for executives | Findings | Vulnerabilities by severity Critical/High/Medium/Low | CVEs Identified | List of CVEs with description and CVSS | CWEs Mapped | Weaknesses categorized by CWE | Exploits Used | Code and payloads used | Access Obtained | Compromised systems and access level | Credentials | Hashes, cracked passwords, API keys | Exposed Secrets | Tokens, keys, certificates found | Timeline | Operation chronology | Responsible Team | Which team discovered each finding | Remediation | Recommended fixes with priority | This workspace works with any AI-powered IDE : | IDE/Assistant | Configuration File | Status | |---|---|---| Windsurf | .windsurfrules | ✅ | Cursor | .cursorrules | ✅ | GitHub Copilot | .github/copilot-instructions.md | ✅ | Cline/Claude Dev | .clinerules | ✅ | Gemini | .gemini | ✅ | Claude | CLAUDE.md | ✅ | Simply open the workspace in your IDE and request: "Pentest example.com" "Analyze these logs for malicious activity" "Scan the code for vulnerabilities" "Create a threat model for the application" "Generate an ISO 27001 compliance report" The AI will automatically identify which team s should act and execute the appropriate tools. Security-Team---Workspace-/ │ ├── 🔴 RedTeam/ Offensive tools │ ├── tools/ │ ├── scripts/ │ ├── wordlists/ │ └── .env.example │ ├── 🔵 BlueTeam/ Defensive tools │ ├── rules/ │ ├── playbooks/ │ ├── iocs/ │ └── .env.example │ ├── 🟣 PurpleTeam/ Validation │ ├── atomic-tests/ │ ├── detections/ │ └── mappings/ │ ├── 🟢 GreenTeam/ DevSecOps │ ├── scanners/ │ ├── policies/ │ └── pipelines/ │ ├── ⚪ WhiteTeam/ GRC │ ├── frameworks/ │ ├── policies/ │ ├── audits/ │ └── templates/ │ ├── 🟡 YellowTeam/ Architecture │ ├── threat-models/ │ ├── architectures/ │ └── requirements/ │ ├── 🟠 OrangeTeam/ Awareness │ ├── campaigns/ │ ├── training/ │ └── templates/ │ ├── 📁 .contexts/ Context configuration │ └── config.json │ ├── 📁 .projects/ Projects isolated contexts │ ├── 📁 .shared/ Shared findings │ ├── 📁 .windsurf/workflows/ Automation workflows │ ├── 📁 reports/ Generated mega reports │ ├── 🔧 secteam CLI Orchestrator ├── 🔧 install.sh Unified installer ├── 📄 .windsurfrules Windsurf config ├── 📄 .cursorrules Cursor config ├── 📄 .clinerules Cline config ├── 📄 .gemini Gemini config ├── 📄 CLAUDE.md Claude config ├── 📄 LICENSE License └── 📄 README.md This file This framework is designed exclusively for authorized use in: - Authorized penetration testing - Contracted security assessments - Ethical security research - Lab environments and CTFs Unauthorized use of these tools is illegal and strictly prohibited. This project is under the Security Research License . See LICENSE /MartinCrespoC/Security-Team---Workspace-/blob/main/LICENSE for details. Contributions are welcome. Please read the contribution guidelines before submitting a PR. Martin Crespo 🛡️ Break Everything. Protect Everything. Report Everything. 🛡️