Documentation

Attestation

AegisGate provides automated compliance attestation with cryptographic evidence integrity.

Evidence Packages

AegisGate generates signed evidence packages for each security detection:

  • Timestamp: RFC 3339 formatted, UTC
  • Detection rule: Rule ID, category, confidence score
  • ML classification: Neural network output (when ML detection enabled)
  • ATLAS mapping: MITRE ATLAS tactic and technique IDs
  • Framework cross-reference: SOC 2, ISO 27001, EU AI Act control IDs

Integrity Verification

Every evidence package is SHA256-hashed for tamper detection:

curl http://localhost:8443/api/v1/compliance/integrity
# Returns: {"algorithm":"sha256","hash":"a1b2c3d4...","patterns":42,"timestamp":"..."}

Signed Reports

For formal attestation, AegisGate can generate signed compliance reports:

curl -H "X-API-Key: your-key" \
     "http://localhost:8443/api/v1/compliance/report?framework=soc2&format=pdf"

See also: Compliance Frameworks and MITRE ATLAS Coverage.