-
-
Notifications
You must be signed in to change notification settings - Fork 0
Security
NexusEdge Hailo Edition implements defense-in-depth security across the entire stack: on-controller, in-transit, and at the cloud layer.
NexusShield is the security middleware that runs on every controller and on the AN server. It provides:
- RBAC enforcement -- 3-level role-based access control (App, Org, Site) applied to every API endpoint and Console action
- Breach detection -- monitors for unauthorized access attempts, privilege escalation, and configuration tampering
- Rate limiting -- per-user and per-IP rate limits on all endpoints
- Session management -- secure token lifecycle with automatic expiration and revocation
Anubis is a neural threat detection model that runs on the Hailo NPU (or CPU fallback). It classifies system events into 34 threat categories:
- Brute force authentication attempts
- Lateral movement between controllers
- Data exfiltration patterns
- Protocol anomalies (BACnet/Modbus malformed packets)
- Insider threat indicators
- Configuration tampering
- Privilege escalation
- Denial of service patterns
- And 26 additional categories
Each detection includes: threat category, severity score (0.0-1.0), source context, and recommended action.
NexusShield can export security events to external SIEM platforms in real time:
| Export Target | Protocol | Format |
|---|---|---|
| Syslog | UDP/TCP/TLS | RFC 5424 |
| Elasticsearch | HTTPS | JSON bulk API |
| Splunk | HTTPS (HEC) | JSON |
| Webhook | HTTPS POST | JSON payload |
SIEM export is configured in the Console Settings page. Multiple export targets can be active simultaneously. Available on Business tier and above.
NexusVault is the embedded credential manager. It stores secrets in AegisDB's Vault paradigm with AES-256-GCM encryption:
- API keys (Cloudflare, Tailscale, weather services)
- BACnet/Modbus device credentials
- Firebase service account tokens
- Email relay credentials (FerrumMail SMTP, baked and obfuscated in binary)
- TLS certificates for Cloudflare tunnels
- ed25519 signing keys for OTA Deploy
NexusVault is the embedded vault within NexusEdge. It is not the standalone HTTP vault daemon.
Three nested authorization levels:
| Level | Scope | Roles |
|---|---|---|
| App | Platform-wide | SuperAdmin, Support |
| Org | Organization/tenant | OrgAdmin, OrgViewer |
| Site | Individual site | SiteAdmin, SiteOperator, SiteViewer |
Permissions cascade: App > Org > Site. A SuperAdmin can access everything. A SiteViewer can only read data for their assigned site.
| Capability | SuperAdmin | OrgAdmin | SiteAdmin | SiteOperator | SiteViewer |
|---|---|---|---|---|---|
| View dashboard | Yes | Yes | Yes | Yes | Yes |
| Adjust setpoints | Yes | Yes | Yes | Yes | -- |
| OTA Deploy | Yes | Yes | Yes | -- | -- |
| Manage users | Yes | Yes | -- | -- | -- |
| SIEM config | Yes | Yes | -- | -- | -- |
| Manage orgs | Yes | -- | -- | -- | -- |
- Binary hardening -- 5-layer obfuscation for embedded sensitive data (XOR, shuffle, zstd compression pattern)
- SLSA Level 3 -- supply chain provenance on all release artifacts (GitHub Actions, sigstore)
- ed25519 OTA signing -- all deployed configurations are cryptographically signed
- Immutable audit trail -- compliance paradigm in AegisDB with cryptographic chaining
- Secret isolation -- credentials never appear in configuration files; all secrets flow through NexusVault
- Cloudflare tunnel -- all remote access goes through encrypted Cloudflare tunnels (no open ports)
- Tailscale -- controller-to-controller mesh VPN for fleet communication
- TLS everywhere -- Console, API, and SIEM export all use TLS
- No inbound ports -- controllers initiate all outbound connections; no listening ports exposed to the internet
NexusEdge Hailo Edition
Getting Started
Platform
Data & Deploy
Security
AutomataNexus LLC