Arete

KPI Cards (Top Row)

• Backup Compliance: % of resources with successful backup in last 24h (from M2)
• Security Score: Composite 0-100 across all security modules (from M3, M4, M14)
• Open Tickets: Count + trend sparkline, broken by priority (from M7)
• Domain Health: % of domains passing all email auth checks (from M4, M5)
• Uptime: Overall SLA % across all monitors (from M6)
• License Compliance: Over/under-licensed count (from M8)

Widgets (Body)

• Alert feed: Real-time stream of events from all modules (WebSocket)
• Client health heatmap: Grid of clients x health dimensions, color-coded
• Quick actions: Common tasks (acknowledge alert, approve triage, run audit)
• Trend charts: 30-day sparklines for key metrics

API Pattern

GET /api/v1/dashboard/kpis          -> { backup: 98.5, security: 82, tickets: 47, ... }
GET /api/v1/dashboard/alerts?limit=20 -> AlertFeedItem[]
GET /api/v1/dashboard/health-matrix   -> { clients: [{name, scores: {backup, security, ...}}] }

Features

• 90-day compliance grid: Per-resource daily backup status (green/red cells). Reuse grid component from C:\GIT\afi-bandaid
• SLA scorecard: RPO/RTO tracking per resource, highlight violations
• Protection gap detection: Resources with no backup configured
• Duration trends: Chart.js line chart showing backup duration over time
• Failure analysis: Group failures by error type, show frequency
• Export: 6 formats (PDF, CSV, Excel, Executive 2-sheet, Technical 10-sheet, Compliance). Reuse export logic from afi-bandaid

Connectors

Reuse Map

Feature Details

• Auth status grid: All domains as rows, auth mechanisms as columns, traffic light status cells. Click cell for details.
• SPF auto-flattening: Recursively resolve include: mechanisms → generate flat IP-based record. Warn when approaching 10 DNS lookup limit or 255 char limit. Auto-generate CNAME-based SPF delegation as alternative.
• DMARC aggregate reports: Accept XML RUA reports via email webhook or file upload. Parse into: source IP, org name, auth results (SPF/DKIM pass/fail counts), policy applied. Visualize as table + pie chart + timeline. Identify unauthorized senders (potential spoofing).
• TLS-RPT monitoring: Parse JSON TLS failure reports. Track MTA-STS policy compliance rate. Alert on delivery failures caused by TLS enforcement.
• BIMI validation: Check SVG logo URL reachability, validate VMC (Verified Mark Certificate) if present, preview brand indicator rendering.
• DANE/TLSA: Monitor certificate fingerprints against published TLSA records. Alert when cert rotation breaks DANE. Auto-generate TLSA records from current certs.
• Best practice scoring: Grade A-F per domain. A = all 8 mechanisms configured and valid. Weighted scoring (SPF/DKIM/DMARC = critical, rest = bonus).
• Remediation wizard: For each failing check, show step-by-step fix. Auto-generate the DNS record value. One-click apply via Cloudflare API for managed domains.
• DKIM rotation: Dual-selector strategy. Stage new key on selector2, validate, switch primary, deprecate old. Zero-downtime rollover.

Reuse Map (PowerShell → TypeScript Port)

API Endpoints

GET    /api/v1/email-security/status                  -> AuthStatusGrid (all domains)
GET    /api/v1/email-security/domains/:domain          -> DomainAuthDetail
POST   /api/v1/email-security/check/:domain            -> Run live check
GET    /api/v1/email-security/spf/:domain/flatten      -> FlattenedSPFRecord
POST   /api/v1/email-security/dmarc-reports            -> Upload XML RUA
GET    /api/v1/email-security/dmarc-reports/:domain     -> ParsedDmarcReports[]
GET    /api/v1/email-security/tls-reports/:domain       -> TlsReportSummary
POST   /api/v1/email-security/remediate/:domain/:check -> Apply fix via Cloudflare API
GET    /api/v1/email-security/scores                    -> DomainScore[] (A-F grades)

Features

• Multi-registrar inventory: Pull domains from Namecheap, Spaceship, SAV, VentraIP, Cloudflare APIs into unified table. Show registrar, expiry, auto-renew, cost, DNS provider.
• Deep WHOIS monitoring: Daily WHOIS snapshots. Diff detection: registrant changes, nameserver changes, status code changes (clientTransferProhibited removal = transfer attempt). Alert on unexpected mutations.
• Certificate monitoring: Watch Certificate Transparency logs via crt.sh API. Track cert expiry dates. Alert on: unexpected certs issued for your domains (phishing), certs expiring within 14 days, new CA issuers.
• TLD price comparison: Scrape/API pricing from multiple registrars for each TLD. Show cheapest provider for renewals and new registrations. Historical price tracking. Bulk renewal cost optimization.
• Renewal calendar: Timeline/Gantt view of upcoming renewals. Cost projections by month. Highlight bulk renewal clusters (e.g., Oct-Nov 2026 = $1,760).
• DNS propagation checker: Multi-location DNS resolution (query resolvers in AU, US, EU, Asia). Show propagation status per location with TTL countdown. Like whatsmydns.net but integrated.
• Domain health score: Composite of DNS config, email auth, SSL status, WHOIS health. A-F grade per domain.
• Consolidation advisor: Identify parked/unused domains (no DNS records, no traffic). Calculate potential savings. Recommend registrar consolidation.

API Endpoints

GET    /api/v1/domains                          -> PaginatedDomainList
GET    /api/v1/domains/:domain                   -> DomainDetail (registrar, WHOIS, certs, health)
GET    /api/v1/domains/:domain/whois-history      -> WhoisSnapshot[]
GET    /api/v1/domains/:domain/certificates       -> CertificateWatch[]
GET    /api/v1/domains/:domain/propagation        -> PropagationResult[]
GET    /api/v1/domains/pricing/:tld               -> TldPricing[] (cross-registrar)
GET    /api/v1/domains/renewals/calendar          -> RenewalCalendarData
GET    /api/v1/domains/consolidation              -> ConsolidationRecommendation[]
POST   /api/v1/domains/sync                       -> Trigger registrar sync

CIPP Features to Replicate

• Tenant overview: Per-client card showing user count, license usage, secure score, conditional access policy count, admin count
• User management: List all users across tenants. Search, filter by MFA status, license, sign-in activity. Actions: reset password, enable/disable MFA, block/unblock sign-in
• Conditional Access: View all CA policies across all tenants. Compare policies. Clone a policy from one tenant to another. Template library of best-practice policies
• Security defaults & baselines: Define standard settings (MFA required, legacy auth blocked, etc.). Audit each tenant against standards. Show compliance %. Auto-remediate gaps (with approval)
• License management: Cross-tenant license inventory. Usage reports (assigned vs consumed). Cost per user. Optimization recommendations (downgrade unused E5 to E3)
• Standards enforcement: Template-based: "All tenants must have X". Scheduled audit runs. Dashboard showing % compliance per standard per tenant
• Alert feed: Risky sign-ins, impossible travel, MFA registration gaps, new global admins, external sharing changes

Existing Code

Network & Diagnostics (15 tools, server-side)

• What's My IP: Show public IPv4/IPv6, ISP name, ASN, geolocation (city, region, country, lat/long, timezone, local time). Auto-detect on page load. Map pin visualization
• Ping: ICMP ping to any host with latency stats (min/avg/max/jitter), packet loss %. Configurable count (1-100). Live results streaming via WebSocket
• Traceroute: Visual network path trace with hop count, latency per hop, ASN lookup per hop. Map visualization of geographic path. Server-side traceroute with streaming output
• Speed Test: Download/upload speed + ping/jitter measurement (Cloudflare-style). WebSocket relay for accurate bandwidth measurement. Results chart with history. Latency under load (bufferbloat detection)
• DNS Lookup / Dig: Full record types (A, AAAA, MX, TXT, CNAME, NS, SOA, SRV, CAA, DNSKEY, TLSA, PTR). Multiple resolver comparison (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS, authoritative NS). Dig-style raw output toggle. Propagation check across resolvers
• DNS History: Historical DNS record changes over time (passive DNS). Integration with SecurityTrails API or community passive DNS. Timeline visualization of record changes
• WHOIS Lookup: Domain registration details: registrar, nameservers, dates, status codes, DNSSEC status. Raw WHOIS output + parsed structured view. Domain age calculation
• Domain Dossier: Comprehensive single-page domain analysis combining: DNS records + WHOIS + SSL certificate + MX records + HTTP headers + security headers + blacklist status. One-click full audit. Export as PDF
• SSL Checker: Certificate chain visualization (tree view), SAN list, validity dates, issuer, cipher suite, TLS version, key size. Security grade (A-F). Certificate expiry countdown. CT log cross-reference
• Certificate Transparency: CT log search (crt.sh API). Find all certificates ever issued for a domain or wildcard. Subdomain discovery via CT logs. Identify rogue/unexpected certificates. Feed discovered subdomains to M54 Attack Surface Monitor
• Port Checker: TCP connect check on any host:port. Preset profiles: Web (80,443), Email (25,587,993,143), Remote (22,3389,5900), Database (3306,5432,1433,27017), Custom. Bulk port scan with results table
• IP Geolocation: Map view with pin for any IP address. ISP/ASN info, reverse DNS, hostname. MaxMind GeoLite2 database (server-side, updated weekly). Bulk IP lookup
• HTTP Header Analyzer: Fetch any URL and display all response headers. Security header audit with pass/fail grading: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CORS headers. Overall security grade (A-F)
• Subnet Calculator: CIDR to IP range converter. Broadcast address, network address, usable hosts count, wildcard mask. Visual subnet breakdown. VLSM calculator. IPv4 and IPv6 support
• Bandwidth Calculator: File size × transfer speed = estimated time. Convert between Mbps/MBps/Gbps. Useful for backup window planning

Developer & Admin Tools (17 tools, mostly client-side)

• JSON Formatter: Format, validate, beautify, minify JSON with syntax highlighting and error detection. Tree view toggle with expand/collapse. Click node → copy JSONPath. Diff two JSON documents side-by-side. Client-side (no data leaves browser)
• Text Diff: Side-by-side or unified diff view. Word/line/character level comparison. Syntax-highlighted. Large file support. Copy diff output. Useful for config comparison
• Code Formatter: Prettier-powered formatting for JavaScript, TypeScript, HTML, CSS, YAML, SQL, GraphQL, XML, Markdown. Language auto-detect. Configurable options (indent size, quotes, semicolons). Client-side via Prettier standalone bundle
• Image Converter: Convert between PNG, JPEG, WebP, GIF, BMP, HEIC/HEIF, SVG→PNG. Quality slider. Batch conversion (drag multiple files). Resize with aspect ratio lock. All client-side via Canvas API
• Base64 Encode/Decode: Text ↔ Base64, file ↔ Base64 data URI. URL-safe variant toggle. Auto-detect input type. Copy to clipboard
• JWT Decoder: Paste token, see decoded header + payload with syntax highlighting. Expiry check with countdown. Signature verification (paste secret/public key). Claim inspection (iss, sub, aud, exp, iat)
• Hash Generator: MD5, SHA-1, SHA-256, SHA-512, HMAC-SHA256 variants. Text or file input. Compare hash to verify file integrity (paste expected hash). Client-side via SubtleCrypto API
• Regex Tester: Live regex with match highlighting, capture groups, named groups. Common patterns library (email, IPv4, IPv6, URL, phone AU, ABN, MAC address). Flags toggles (g, i, m, s, u). Match count and group extraction table
• Cron Expression Builder: Visual cron builder with dropdown selectors for minute/hour/day/month/weekday. Human-readable description auto-generated. Next 10 run times preview with timezone. Standard (5-field) + Quartz (6-field) syntax support
• Epoch/Date Converter: Unix timestamp (seconds/milliseconds) ↔ human date. ISO 8601 format. Relative time ("3 hours ago"). Multi-timezone converter. Current epoch live counter
• QR Code Generator: URL, WiFi config (SSID/password/encryption), vCard, plain text, email, phone, SMS. Download as PNG/SVG. Configurable size, error correction level, colors. Bulk generation from CSV
• Password Generator: Configurable length (8-128), character sets (upper, lower, digits, symbols, ambiguous exclusion). Passphrase mode (diceware/EFF wordlist). Bulk generation (up to 100). Strength meter (zxcvbn) + HIBP breach check. Copy + auto-clear clipboard after 30s
• UUID/ULID Generator: UUID v1 (timestamp), v4 (random), v7 (timestamp-sortable). ULID generation. Bulk generation with copy. Decode UUID v1 timestamp
• Color Converter: HEX ↔ RGB ↔ HSL ↔ CMYK. Visual color picker. Contrast ratio checker (WCAG AA/AAA). Palette generator (complementary, analogous, triadic)
• Markdown Preview: Live split-pane editor with GFM support (tables, task lists, footnotes). Syntax highlighting for code blocks. Export to HTML/PDF. Mermaid diagram rendering
• YAML ↔ JSON Converter: Bidirectional conversion with validation and error highlighting. Supports multi-document YAML. Pretty-print output
• URL Encoder/Decoder: Encode/decode URL components. Parse query strings into editable table view. Rebuild URL from components. URI component vs full URL encoding

Security Tools (6 tools)

• Security Headers Check: Analyze any URL's response headers against OWASP best practices. Individual pass/fail per header with recommendations. Overall grade (A-F). Compare against industry benchmarks. Server-side fetch
• Cookie Inspector: Fetch URL and display all cookies with attributes: Name, Value, Domain, Path, Secure, HttpOnly, SameSite, Expires. Flag insecure cookies (missing Secure/HttpOnly on sensitive domains). Server-side
• Certificate Transparency Log: Search crt.sh API for all certificates issued for a domain. Discover subdomains from SAN fields. Timeline of certificate issuance. Identify unexpected/rogue certificates. Feed results to M54 Attack Surface Monitor
• Subdomain Finder: Combine CT log search + DNS brute-force (common wordlist) + public sources. Deduplicate and resolve each subdomain. Export list. One-click "Add to M54 monitoring"
• Content Security Policy Builder: Visual CSP builder with directive explanations (default-src, script-src, style-src, img-src, etc.). Test policy against live URL. Common presets (strict, moderate, permissive). Export as header value or meta tag
• MIME Type Validator: Upload file, detect actual MIME type via magic bytes vs file extension. Flag mismatches. Useful for verifying file integrity and detecting disguised malware

PDF & Document Tools (10 tools)

• PDF Merge: Combine multiple PDFs into one. Drag-and-drop reorder. Client-side (pdf-lib)
• PDF Split: Extract page ranges from a PDF. Preview thumbnails. Client-side
• PDF Compress: Reduce PDF file size with quality presets (screen, ebook, print). Client-side
• PDF Convert: Word/HTML/Markdown → PDF (Puppeteer server-side). Configurable page size, margins, headers/footers
• PDF Sign: Digital signature placement (pdf-lib + canvas for signature drawing). Position signature on specific page/location
• OCR: Extract text from scanned PDFs and images (Tesseract.js client-side). Multi-language support
• Image Format Converter: SVG generator (shapes, icons, patterns). Format conversion (HEIF/HEIC → JPEG, WebP ↔ PNG, SVG → PNG). Resize/crop with presets
• PDF Viewer: pdf.js embedded viewer with annotations, search, zoom
• DOCX/XLSX Viewer: Word (mammoth.js) and Excel (SheetJS) rendering in-browser
• Markdown Viewer: remark/rehype pipeline with syntax highlighting, table support, Mermaid diagrams

Frontend Layout

• Tool Hub (/tools): Grid of tool cards with icons. Category filter tabs: All | Network | Security | Developer | Documents. Search bar with fuzzy matching. "Recently used" and "Favorites" sections at top
• Individual tool pages: Clean single-purpose UI. Input area (left/top) + Output area (right/bottom). Copy/download buttons on all outputs. Share result via M80 Secure Sharing link
• Tool usage analytics: Usage logged to ToolUsageLog model. "Most popular tools" widget for M1 Executive Dashboard. Per-technician tool usage in M65 BI

API Endpoints (server-side tools only)

GET    /api/v1/tools/my-ip                           -> PublicIpInfo { ipv4, ipv6, isp, asn, geo }
POST   /api/v1/tools/ping                            -> PingResult { host, stats, packets[] } (WebSocket for live)
POST   /api/v1/tools/traceroute                      -> TracerouteResult { hops[] } (WebSocket for live)
WS     /api/v1/tools/speed-test                      -> SpeedTestResult { download, upload, ping, jitter }
POST   /api/v1/tools/dns-lookup                      -> DnsRecords { records[], resolver }
GET    /api/v1/tools/dns-history/:domain              -> DnsHistory[] (SecurityTrails API proxy)
GET    /api/v1/tools/whois/:domain                   -> WhoisResult { parsed, raw }
GET    /api/v1/tools/domain-dossier/:domain           -> DomainDossier { dns, whois, ssl, mx, headers, blacklist }
POST   /api/v1/tools/ssl-check                       -> SslCertInfo { chain[], grade, expiry, sans[] }
GET    /api/v1/tools/ct-logs/:domain                  -> CtLogEntry[] (crt.sh API proxy)
POST   /api/v1/tools/port-check                      -> PortCheckResult { ports[] }
GET    /api/v1/tools/ip-geolocation/:ip               -> GeoResult { city, region, country, latLong, isp, asn }
POST   /api/v1/tools/http-headers                    -> HeaderAnalysis { headers[], securityGrade }
POST   /api/v1/tools/security-headers                -> SecurityHeaderGrade { checks[], grade }
POST   /api/v1/tools/subnet-calc                     -> SubnetCalcResult { network, broadcast, hosts, range }
POST   /api/v1/tools/subdomain-finder                -> SubdomainResult[] { subdomain, ip, source }
POST   /api/v1/tools/cookie-inspect                  -> CookieResult { cookies[] }

Note: Client-side tools (JSON formatter, text diff, code formatter, image converter, hash gen, regex, cron, base64, JWT, UUID, color, markdown, YAML, URL encoder) run entirely in-browser with zero API calls. No data leaves the user's device.

Cross-Module Integration

• M4 Email Security: DNS Lookup feeds SPF/DKIM/DMARC validation results
• M5 Domain Management: WHOIS + SSL + Domain Dossier provide domain health data
• M28 Network Discovery: Port checker and subnet calculator assist network mapping
• M38 IPAM: Subnet calculator integrates with IP address management
• M39 DNS Operations: DNS lookup + DNS history validate DNS changes
• M54 Attack Surface: CT logs + subdomain finder feed external asset discovery
• M65 BI Warehouse: ToolUsageLog provides usage analytics data
• M76 Email Infra: Security headers check validates email server config
• M80 Secure Sharing: Any tool output can be shared via secure ephemeral link

Key Features

• Vulnerability dashboard: CVE severity distribution (Critical/High/Medium/Low donut), trending over time, remediation tracking with SLA
• Endpoint protection: Agent deployment coverage per client, gap detection, auto-alert on unprotected devices
• Threat feed: Real-time aggregated alerts from all security vendors, unified severity normalization
• Client security score: 0-100 composite (vuln count 30%, patch currency 25%, protection coverage 25%, config compliance 20%)
• Essential Eight maturity: Map findings to ACSC Essential Eight controls, show maturity level per control

Connectors

Existing (Already in Arete)

• Monitor, CheckResult, Incident, UptimeStats models
• StatusPage, StatusComponent, StatusIncident models
• AlertChannel, AlertPolicy models
• API routes for CRUD + status page public API

Extensions Needed

• Additional probe types: TCP, DNS, ICMP, gRPC (currently HTTP only)
• Prometheus metrics export for Grafana integration
• Maintenance window scheduling
• Response time percentile charts (P50/P95/P99)

Features

• AI triage: Auto-suggest Type/Subtype/Item with confidence %. Side-by-side current vs suggested. Approve/deny workflow. Reuse: C:\GIT\cw-triage-dashboard
• Semantic search: Natural language query → pgvector cosine similarity. "Show me tickets about email delivery issues for Construction Control". Reuse: Knowledge-DB embedding worker pattern
• Trend analysis: Ticket volume over time by type, client, technician. Chart.js time series
• SLA tracking: Response/resolution time vs targets. Breach alerts
• Technician workload: Billable utilization gauge (actual vs target), hours by category, balance across team
• Customer health: Composite of ticket volume, SLA performance, recurring issues, sentiment
• Quick wins: Low-effort/high-impact tickets scored and ranked. Reuse: Grafana kb-quick-wins design
• Zammad integration (optional): Connect Zammad helpdesk for customer-facing multichannel support (email, chat, phone, social media, web forms). Client-submitted tickets auto-sync to CW/Autotask PSA. Enables M27 Client Portal ticket submission via Zammad's multi-channel engine

Features

• Device inventory with sync from RMM + PSA
• Software license count vs entitlement tracking
• Compliance alerts (over/under-licensed)
• Warranty tracking, EOL/EOS alerts with timeline
• Cost optimization recommendations
• SaaS auto-discovery: Scan SSO/IAM/IDP login events (Entra ID, Okta, Google Workspace) via Microsoft Graph and Google Workspace APIs to detect SaaS subscriptions not in official inventory. Flag shadow IT. Feed M22 Profitability for cost analysis

Features

• PDF reports: Server-side via Puppeteer (HTML template → PDF). Branded with logo, colors, footer
• PDF signing: Digital signature placement for compliance deliverables (node-signpdf)
• Excel workbooks: Multi-sheet with pivot-ready data (ExcelJS). Executive summary sheet + detail sheets
• Scheduled reports: Cron-based generation. Weekly security posture, monthly backup compliance, quarterly QBR
• Templates: Per-module report templates. Customizable sections, chart selection, data range
• White-labeling: Logo, primary/secondary colors, company name, contact info per tenant

Reuse

Entire C:\GIT\connectwise-email-audit\: cw-api-client.ps1, cw-data-parser.ps1, cw-investigator.ps1, html-generator.ps1. Port to TypeScript connector + service layer.

Reuse

C:\Users\Tom\infrastructure-audit.html (80+ services, 14 categories, Work Mode toggle, live search). Port to React with Docker API integration for live container health.

Features

• Domain breach monitoring via HIBP API (domain search endpoint)
• Credential leak alerts with affected user count
• CT log watching via crt.sh API (new certs for monitored domains)
• Typosquatting detection (Levenshtein distance on domain names)

Reuse

Arete's existing breach-scanner module + C:\GIT\breach-intel repo structure.

Reuse

C:\GIT\Argus (SvelteKit + D3.js). Port 10 visualization tabs to React: Sankey (password reuse flow), Network (site connections), Bubble (strength), Treemap (categories). Keep IndexedDB for local persistence.

Reuse

/opt/backup-catalog/ PostgreSQL schema + collector scripts. Build React frontend for query.sh CLI capabilities (status, recent, missing, size).

Features

• Reboot schedule management (create, modify, cancel)
• State machine visualization (Idle → Scheduled → Rebooting → Complete/Failed)
• Compliance dashboard (uptime days vs 30-day policy)
• Audit trail viewer (append-only history per device)

Reuse

6 PowerShell scripts + 20 custom field definitions from G:\Documents\Bidness\NinjaOne\scripts\. 8 Mermaid architecture diagrams from Architecture-Diagrams.md.

Reuse

10 standardized API docs from G:\Documents\Bidness\API-Standards\ (AFI 22KB, NinjaOne 24KB, Sophos 13KB, Tenable 12KB, ThreatLocker 9KB, ScalePad 11KB, Atlassian 14KB, Microsoft Graph 17KB, Partner Center 16KB, Keeper 15KB). Parse markdown → render with syntax highlighting + interactive endpoint tester.

Features

• Step-by-step wizard: Progress bar, save & resume, back/forward navigation. Steps: Company Info → Service Tier → API Credentials → Initial Sync → Monitor Setup → Review
• Checklist generator: Auto-generate onboarding checklist based on service tier (M365, infrastructure-only, full-stack managed)
• Auto-provision: Create Arete tenant, invite initial users, connect APIs with validation, set default monitors and alert policies
• Document collection: Upload agreements, licenses, network diagrams. Stored as ClientDocuments (shared with M27)
• Integration kickoff: Auto-trigger first sync for all connected services (backup, security, M365). Show real-time sync progress
• Template library: Customizable onboarding templates per service tier. Clone and modify for specific client needs
• Time-to-value tracking: Measure days from signup to full monitoring coverage. Dashboard metric for M1

API Endpoints

POST   /api/v1/onboarding/workflows              -> Create new onboarding
GET    /api/v1/onboarding/workflows/:id           -> Get workflow status
PATCH  /api/v1/onboarding/workflows/:id/steps/:n  -> Complete/update step
GET    /api/v1/onboarding/templates                -> List templates
POST   /api/v1/onboarding/templates                -> Create template
POST   /api/v1/onboarding/workflows/:id/provision  -> Trigger auto-provisioning
GET    /api/v1/onboarding/metrics                  -> Time-to-value stats

Supported Frameworks

Features

• Per-client maturity matrix: Control → status (not implemented/partial/implemented) → evidence links. Color-coded heatmap view
• Auto-evidence collection: Pull data from security modules (M3 vulns, M4 email auth, M9 MFA status, M23 patch compliance) to auto-satisfy controls
• Gap analysis: Prioritized remediation roadmap with effort estimates. Link gaps to playbooks (M21) for resolution
• Audit-ready reports: PDF report with timestamped evidence snapshots. Generated via M10 Reporting Engine
• Compliance score trending: Track % compliance over time per framework per client. Chart.js line graph
• Control-to-module mapping: Visual matrix showing which Arete modules satisfy which compliance controls

API Endpoints

GET    /api/v1/compliance/frameworks                     -> Framework[]
GET    /api/v1/compliance/clients/:clientId               -> ClientComplianceSummary
GET    /api/v1/compliance/clients/:clientId/:frameworkId  -> ControlStatusMatrix
POST   /api/v1/compliance/evidence/collect/:clientId      -> Trigger auto-evidence collection
GET    /api/v1/compliance/gaps/:clientId                  -> PrioritizedGap[]
GET    /api/v1/compliance/scores/:clientId/trend          -> ComplianceTrend[]

Built-in Playbooks

Features

• Visual builder: Flowchart-style editor. Drag & drop step types: Manual, Automated (API call), Approval (manager gate), Notification, Conditional (if/else), Delay
• Trigger engine: Alerts from any module can trigger playbooks. Configurable conditions (severity, count threshold, time window)
• SLA timers: Per-step time limits. Auto-escalate if overdue. Visual countdown in execution view
• Execution audit trail: Full history with timestamps, actors, inputs/outputs. Compliance-ready logging
• Playbook versioning: Edit creates new version. Rollback to previous. Side-by-side diff view

API Endpoints

GET    /api/v1/playbooks                          -> Playbook[]
POST   /api/v1/playbooks                          -> Create playbook
GET    /api/v1/playbooks/:id                      -> PlaybookDetail (with steps)
POST   /api/v1/playbooks/:id/execute              -> Trigger manual execution
GET    /api/v1/playbooks/executions                -> PlaybookExecution[] (active + history)
PATCH  /api/v1/playbooks/executions/:id/steps/:n  -> Complete step (manual/approval)

Features

• Revenue vs cost per client: Agreement MRR vs actual technician time × loaded rate. Traffic light margin indicator (green >40%, amber 20-40%, red <20%)
• Service margin breakdown: Split by managed services (recurring), projects, break-fix. Stacked bar chart per client
• Technician utilization: Billable hours / available hours gauge. Effective hourly rate (revenue / hours). Compare across team
• Client health quadrant: Scatter plot: X=profitability, Y=satisfaction (CSAT from M66). Quadrants: Stars (high/high), Cash Cows (high prof/low sat), Problem Children (low prof/high sat), Dogs (low/low)
• Agreement optimization: Flag under-priced agreements where actual effort exceeds agreement value by >20%. Suggest price adjustment amount
• MRR trends: Monthly recurring revenue trending with growth rate. Churn risk indicators (declining tickets, missed SLAs, low engagement)
• What-if modelling: Slider for price change → show projected impact on margin. "If we increase Client X by $500/mo, margin goes from 15% to 32%"

Data Sources

API Endpoints

GET    /api/v1/profitability/clients              -> ClientProfitability[]
GET    /api/v1/profitability/clients/:id           -> ClientProfitabilityDetail
GET    /api/v1/profitability/technicians           -> TechnicianUtilization[]
GET    /api/v1/profitability/agreements/flagged    -> UnderPricedAgreement[]
GET    /api/v1/profitability/mrr/trend             -> MrrTrendData
POST   /api/v1/profitability/what-if               -> WhatIfResult

Features

• Compliance grid: Per-device, per-update matrix. Status: Installed (green), Pending (amber), Failed (red), Excluded (grey). Filterable by client, OS, severity
• Critical/zero-day tracking: Highlight critical patches with SLA countdown timer. Alert when SLA about to breach
• Patch rings: Test (5% devices) → Pilot (20%) → Broad (75%). Auto-promote after X days with no failures. Ring membership configurable per client
• Third-party patching: Chrome, Firefox, Adobe, Java, 7-Zip, etc. Track version currency across fleet
• Reboot-pending tracking: Devices needing reboot after patch install. Ties into M17 NinjaOne Automation for scheduled reboots
• Historical trending: Compliance % over time per client. Line chart with 30/60/90 day view
• Patch Tuesday digest: Auto-generated summary of monthly Microsoft patches. Risk-rated (critical count, zero-day count, affected products)

API Endpoints

GET    /api/v1/patching/compliance                -> ComplianceSummary (by client)
GET    /api/v1/patching/devices/:deviceId          -> DevicePatchStatus
GET    /api/v1/patching/critical                   -> CriticalPatch[] (with SLA)
GET    /api/v1/patching/rings                      -> PatchRingConfig[]
PATCH  /api/v1/patching/rings/:id                  -> Update ring config
GET    /api/v1/patching/trend/:clientId             -> ComplianceTrend[]
GET    /api/v1/patching/digest/:month              -> PatchTuesdayDigest

Features

• Scheduled restore verification: Define test schedule per client (monthly, quarterly). Auto-trigger test restore from latest backup
• Screenshot verification: Boot VM from backup image, wait for OS load, capture screenshot, AI-verify successful boot (green checkmark or red X)
• File-level integrity: Restore random sample of files, compare checksums against source. Report % integrity
• DR runbook per client: Document RTO/RPO targets, restore priority order (AD → Email → LOB apps), contact chain, failover procedures
• Test result history: Pass/fail trending over time. Last successful test date prominently displayed. Alert if overdue
• Compliance certificates: Auto-generate "Backup tested and verified on [date]" PDF certificates. Tied to M20 compliance evidence
• Failover simulation: Track DR rehearsal exercises. Measure actual RTO vs target. Document deviations and improvements

API Endpoints

GET    /api/v1/dr/tests                           -> DrTest[] (scheduled + completed)
POST   /api/v1/dr/tests                           -> Schedule new test
GET    /api/v1/dr/tests/:id/results               -> DrTestResult[]
GET    /api/v1/dr/runbooks/:clientId               -> DrRunbook (with steps)
PUT    /api/v1/dr/runbooks/:clientId               -> Update runbook
GET    /api/v1/dr/certificates/:testId             -> PDF certificate (stream)
GET    /api/v1/dr/compliance/:clientId              -> DR compliance status

Workflow

Draft → Submitted → Under Review (CAB) → Approved/Rejected → Scheduled → Implementing → Verifying → Complete
                                                          ↓
                                               Emergency Fast-Track (retrospective required)

Features

• RFC submission form: Title, description, affected systems, risk assessment (auto-scored), rollback plan, implementation window, testing plan
• Risk matrix: Auto-score based on: scope (single device vs infrastructure-wide), timing (business hours vs maintenance window), systems affected (critical vs non-critical), reversibility
• CAB approval: Configurable approvers per risk level. Low risk = auto-approve. Medium = single approver. High = full CAB. Email/Teams notifications
• Change calendar: Visual timeline of all scheduled changes across clients. Conflict detection (overlapping maintenance windows)
• Post-implementation review: Mandatory for high-risk changes. Success/failure, lessons learned, actual vs planned duration
• Emergency changes: Fast-track path that skips CAB but requires retrospective review within 48 hours
• Integration: Link changes to tickets (M7), playbooks (M21), maintenance windows (M6). Auto-create ticket when change is approved

API Endpoints

GET    /api/v1/changes                            -> ChangeRequest[] (with filters)
POST   /api/v1/changes                            -> Submit RFC
GET    /api/v1/changes/:id                        -> ChangeRequestDetail
PATCH  /api/v1/changes/:id/approve                -> CAB approval action
PATCH  /api/v1/changes/:id/implement              -> Mark as implementing
POST   /api/v1/changes/:id/review                 -> Submit post-implementation review
GET    /api/v1/changes/calendar                   -> ChangeCalendarData

Example Queries

Features

• Chat interface: Persistent sidebar or full-page chat. Markdown rendering for responses. Code blocks for technical output
• Context-aware: Knows current user, tenant scope, active page/module. "Show me more details on this client" works from any module
• Function calling: Claude/OpenAI function calling against all Arete API endpoints. Read-only by default, write actions require confirmation modal
• Knowledge base: RAG over ticket history, KB articles, past incidents using pgvector embeddings (M7 infrastructure)
• Suggested questions: Based on current alerts and anomalies. "3 clients have failing backups — want to see details?"
• Multi-modal: Accept screenshot uploads (error messages), return charts/tables inline in chat
• Conversation history: Persistent conversations per user. Searchable. Share conversations with team

Tech Stack

// AI Provider: Claude API (preferred) or OpenAI, configurable per tenant
// Function definitions: Auto-generated from Arete's OpenAPI spec
// Embeddings: Ollama local or OpenAI ada-002 for RAG
// Streaming: Server-Sent Events for real-time token delivery
// Rate limiting: Per-user token budget (configurable)

API Endpoints

POST   /api/v1/copilot/chat                       -> Stream chat response (SSE)
GET    /api/v1/copilot/conversations                -> UserConversation[]
GET    /api/v1/copilot/conversations/:id            -> ConversationDetail
DELETE /api/v1/copilot/conversations/:id            -> Delete conversation
GET    /api/v1/copilot/suggestions                  -> SuggestedQuestion[]

Features

• Custom branding: Logo, primary/accent colors, company name, custom domain (client.arete.dev or client's own domain via CNAME). Auto-logo population via logo.dev API — client logos fetched by domain name, no manual upload needed. Fallback: professional monogram generated automatically
• Client dashboard: Their backup status (M2), security score (M3), open tickets (M7), uptime (M6). Simplified KPI cards
• Ticket management: Submit new tickets with category picker. View open/closed tickets. Add notes/attachments. Limited to their own tickets only
• Document library: Access SOWs, reports, compliance certificates, network diagrams. Uploaded by MSP via M19 onboarding or manually
• Approval workflows: Approve change requests (M25), acknowledge security alerts, authorize emergency access
• Service catalog: Request new services (new user, license change, hardware). Auto-creates ticket in M7
• Satisfaction surveys: Post-ticket CSAT (1-5 stars + comment). Periodic NPS survey (quarterly). Results feed into M22 client health
• Self-service: Password reset requests, user onboarding requests, contact info updates

Auth

Separate authentication from MSP staff. Options: Zitadel realm per client, magic link (email verification), or M365 SSO (Graph API). No access to other clients' data.

API Endpoints

GET    /api/v1/portal/config/:clientId             -> PortalConfig + Branding
PUT    /api/v1/portal/config/:clientId             -> Update branding
GET    /api/v1/portal/dashboard                    -> ClientDashboard (scoped)
GET    /api/v1/portal/tickets                      -> ClientTicket[] (their tickets only)
POST   /api/v1/portal/tickets                      -> Submit ticket
GET    /api/v1/portal/documents                    -> ClientDocument[]
POST   /api/v1/portal/surveys                      -> Submit survey response
GET    /api/v1/portal/services                     -> ServiceCatalog[]
POST   /api/v1/portal/services/request             -> Request service

Features

• Auto-discovery: Scan subnets via agent (NinjaOne script or dedicated agent). ARP table collection, SNMP queries, optional nmap. Classify: server, workstation, network device, printer, IoT, unknown
• Interactive topology map: D3.js force-directed graph. Nodes = devices (colored by type), edges = connections. Click node for details. Zoom/pan. Filter by subnet/VLAN
• VLAN & subnet visualization: Visual subnet layout showing IP usage, DHCP range, gateway. Color-code by utilization (%)
• Rogue device detection: Alert on unknown MAC addresses not in known device inventory. Auto-flag and notify. Compare against M8 asset inventory
• Port/service inventory: Per-device list of open ports and detected services. Flag unexpected services (e.g., RDP on workstation)
• Historical tracking: Device first-seen/last-seen dates. IP change history. Device disappearance alerts
• Export: CSV device inventory, SVG/PNG topology diagram, Visio-compatible XML
• M8 reconciliation: Compare discovered devices against asset inventory. Flag unmanaged devices. Suggest additions

API Endpoints

POST   /api/v1/network/scans                      -> Trigger subnet scan
GET    /api/v1/network/scans/:id                   -> ScanResult (with devices)
GET    /api/v1/network/devices/:clientId            -> DiscoveredDevice[]
GET    /api/v1/network/topology/:clientId           -> TopologyGraph (nodes + edges)
GET    /api/v1/network/subnets/:clientId            -> SubnetConfig[]
GET    /api/v1/network/rogue/:clientId              -> RogueDevice[]
GET    /api/v1/network/devices/:deviceId/history    -> DeviceHistory[]

Features

• Multi-cloud dashboard: Aggregate spend per client across Azure, AWS, M365. Monthly trend with MoM change %. Breakdown by service/resource group
• M365 license optimization: Identify unused licenses (last sign-in > 90 days). Downgrade recommendations (E5 → E3 if premium features unused). Monthly savings projection
• Azure right-sizing: VM CPU/memory utilization analysis. Recommendations: downsize over-provisioned, shut down idle, convert to reserved instances
• Reserved instance advisor: Compare on-demand vs 1yr vs 3yr reserved pricing. Show break-even point. Recommend based on usage patterns
• Cost anomaly detection: ML-based baseline per client/service. Alert on spend > 2σ above baseline. Investigate: which resource caused the spike
• Budget tracking: Set monthly thresholds per client/service. Alert at 80%, 100%, 120%. Visual burn-rate gauge
• Savings report: Monthly summary: implemented savings, potential savings, recommendations. PDF export for client QBR
• Chargeback/showback: Allocate shared infrastructure costs to departments/cost centers using tagging

Connectors

API Endpoints

GET    /api/v1/cloud-cost/summary/:clientId        -> CostSummary (all providers)
GET    /api/v1/cloud-cost/trend/:clientId           -> MonthlyCostTrend[]
GET    /api/v1/cloud-cost/licenses/:clientId        -> LicenseUtilization[]
GET    /api/v1/cloud-cost/recommendations/:clientId -> CostRecommendation[]
GET    /api/v1/cloud-cost/anomalies/:clientId       -> CostAnomaly[]
GET    /api/v1/cloud-cost/budgets/:clientId         -> CostBudget[]
PUT    /api/v1/cloud-cost/budgets/:clientId         -> Set budget thresholds
GET    /api/v1/cloud-cost/savings-report/:clientId  -> MonthlySavingsReport

Features (Already Implemented)

• 7 space types: Desk, Hot Desk, Room, Meeting Room, Phone Booth, Locker, Parking (with 7 subtypes: standard, compact, accessible, ev, reserved, motorcycle, bicycle)
• Approval workflows: Configurable per space type, manager approval chain, auto-approve for recurring bookings
• Calendar sync: Google Calendar, Outlook (CalDAV), bidirectional sync with conflict detection
• Booking rules engine: Max duration, advance booking limits, check-in/check-out, no-show auto-cancel
• Floor plans: Interactive SVG with clickable spaces, real-time availability overlay
• Analytics: Utilization heatmaps, peak usage patterns, space ROI calculations
• 5 BullMQ workers: Reminder notifications, waitlist processing, recurring booking generation, check-in enforcement, analytics aggregation

API (60+ existing endpoints)

GET    /api/v1/spaces                    -> PaginatedSpaces
POST   /api/v1/bookings                  -> Create booking
GET    /api/v1/bookings/calendar          -> Calendar view
POST   /api/v1/bookings/:id/check-in     -> Check in
GET    /api/v1/analytics/utilization      -> Heatmap data
// ... 55+ more endpoints already built

Features

• Product catalog: Search by serial, model, product name. Live search with autocomplete. Product images, specs, compatibility info
• Inventory tracking: Quantity on hand, reorder points, location tracking (warehouse, client site, in transit)
• Purchase orders: Create PO, track status (draft/submitted/approved/shipped/received), line items with quantities and pricing
• Distributor pricing: Compare prices across Dicker Data, Synnex, Ingram Micro, Westcon-Comstor APIs. Show cheapest source for each product
• Quote-to-order: Generate client quotes from catalog, convert approved quotes to POs. Future: QuoteWerks and CW Sell integration
• Cost tracking: Per-item cost history, bulk pricing tiers, shipping cost estimation
• Vendor catalog sync: Auto-import product catalogs from distributor APIs. Daily price refresh

API Endpoints

GET    /api/v1/procurement/products               -> ProductCatalog (search/filter)
GET    /api/v1/procurement/products/:id            -> ProductDetail
GET    /api/v1/procurement/inventory               -> InventoryList
POST   /api/v1/procurement/purchase-orders          -> Create PO
GET    /api/v1/procurement/pricing/:productId       -> DistributorPricing[]
POST   /api/v1/procurement/quotes                   -> Create quote
POST   /api/v1/procurement/quotes/:id/convert       -> Convert to PO

Features

• Cross-module data pull: M2 backup compliance, M3 security score, M6 uptime SLA, M7 ticket trends, M20 compliance maturity, M22 profitability, M23 patch status, M29 cloud costs, M63 health score
• Branded output: Client logo, colors, MSP branding. PDF and PowerPoint formats via M10 Reporting Engine
• AI executive summary: Claude/OpenAI generates natural language summary of quarter highlights, risks, recommendations (via M26 Copilot)
• Trend comparison: This quarter vs last quarter. Improvement/degradation indicators with percentage change
• Customizable sections: Drag-and-drop section ordering. Include/exclude modules per client. Custom narrative sections
• Scheduled generation: Auto-generate on quarterly cadence (configurable start dates). Email delivery to client contacts

API Endpoints

POST   /api/v1/qbr/generate/:clientId              -> Generate QBR
GET    /api/v1/qbr/templates                        -> QbrTemplate[]
GET    /api/v1/qbr/history/:clientId                -> QbrReport[]
GET    /api/v1/qbr/preview/:clientId                -> QbrPreviewData
PATCH  /api/v1/qbr/schedules/:clientId              -> Update schedule

Features

• Vendor directory: Contact info, account managers, support portals, SLA terms per vendor
• Contract management: Track agreement terms, renewal dates, pricing tiers, discount structures
• Distributor accounts: Dicker Data, Synnex, Ingram Micro, Westcon-Comstor — account credentials, rep contacts, pricing tier status
• Expiry alerts: 30/60/90 day warnings for contract renewals. Auto-create M7 tickets for upcoming renewals
• Pricing tier tracking: Current tier, next tier requirements, volume tracking toward tier upgrades
• Vendor scorecard: Rate vendors on response time, pricing, support quality. Compare side-by-side

API Endpoints

GET    /api/v1/vendors                              -> Vendor[]
GET    /api/v1/vendors/:id                           -> VendorDetail
GET    /api/v1/vendors/:id/contracts                  -> Contract[]
GET    /api/v1/vendors/expiring                      -> ExpiringContract[]
POST   /api/v1/vendors/:id/scorecard                 -> Submit rating

Features

• Cert tracking: Microsoft, Sophos, Datto, CompTIA, ITIL, Cisco, etc. Per-tech cert inventory with expiry dates
• Expiry alerts: 30/60/90 day warnings. Auto-create renewal reminder tasks
• CPD hours: Log continuing professional development hours. Track against annual requirements
• Training requirements: Define required certs per role/tier. Identify gaps in team coverage
• Skills matrix heatmap: Visual grid showing team competencies. Identify single points of failure (only one person with cert X)
• Cert-to-skill mapping: Which certs cover which competencies. Recommend training paths

API Endpoints

GET    /api/v1/training/technicians                  -> TechCertSummary[]
GET    /api/v1/training/technicians/:id               -> TechCertDetail
POST   /api/v1/training/certifications                -> Add certification
GET    /api/v1/training/expiring                      -> ExpiringCert[]
GET    /api/v1/training/skills-matrix                 -> SkillsMatrix
GET    /api/v1/training/requirements/:role            -> RequiredCert[]

Features

• Warranty lookup: Device serial → warranty status, expiry, coverage type. Bulk lookup across fleet
• EOL/EOS alerts: End-of-life and end-of-support tracking with replacement recommendations
• Lifecycle reporting: Fleet age distribution charts. Devices past warranty, approaching EOL, in coverage
• Replacement planning: Budget projections for hardware refresh cycles. Priority scoring (oldest + most critical first)
• Warranty renewal quotes: Generate renewal quotes via ScalePad. Track renewal decisions

API Endpoints

GET    /api/v1/warranty/devices                     -> DeviceWarranty[]
GET    /api/v1/warranty/devices/:serial              -> WarrantyDetail
GET    /api/v1/warranty/eol                          -> EolDevice[]
GET    /api/v1/warranty/lifecycle/report/:clientId   -> LifecycleReport
POST   /api/v1/warranty/sync                         -> Trigger ScalePad sync

Features

• Structure discovery: Crawl existing SharePoint sites via Graph API → generate folder tree diagrams
• Template library: Pre-built structures for Legal, Finance, HR, Projects, Client Folders. MSP best practices
• Visual tree editor: Drag-and-drop folder reorganization. Permission inheritance visualization
• Bulk provisioning: Apply template to new SharePoint site with one click. Create libraries, folders, default permissions
• Recommendations: AI-powered suggestions based on industry and company size

API Endpoints

GET    /api/v1/sharepoint/sites/:tenantId           -> SharePointSite[]
GET    /api/v1/sharepoint/structure/:siteId          -> FolderTree
GET    /api/v1/sharepoint/templates                  -> Template[]
POST   /api/v1/sharepoint/provision                  -> Apply template to site
POST   /api/v1/sharepoint/templates                  -> Create template

Features

• Config export: Dump full tenant config to JSON/YAML — CA policies, compliance policies, device configs, app deployments, Entra settings
• Config import: Apply exported config to another tenant (clone tenant setup). Dry-run mode with change preview
• Drift detection: Schedule baseline snapshots. Alert on deviations from golden config. Show exact diff of what changed
• Design review: AI-assisted review against E8, CIS benchmarks, ASD Blueprint for Secure Cloud. Recommendation engine
• Diff viewer: Side-by-side comparison of two tenants or two snapshots. Highlight differences with color coding
• Maester.dev integration: Run PowerShell test automation. Show pass/fail results per test. Track compliance trending

API Endpoints

POST   /api/v1/m365-config/export/:tenantId         -> ConfigExport
POST   /api/v1/m365-config/import/:tenantId         -> Apply config
GET    /api/v1/m365-config/drift/:tenantId           -> DriftReport
POST   /api/v1/m365-config/review/:tenantId          -> DesignReview
GET    /api/v1/m365-config/diff/:id1/:id2            -> ConfigDiff
GET    /api/v1/m365-config/baselines                 -> SecurityBaseline[]

Features

• Subnet management: Plan and allocate subnets per client/site. Tree view of subnet hierarchy
• IP assignments: Track device, purpose, VLAN, site for each IP. Search and filter
• Conflict detection: Alert on duplicate IP assignments across clients
• DHCP scope visualization: Visual range display showing allocated, available, reserved
• DNS correlation: Link forward (A/AAAA) and reverse (PTR) records to IP assignments
• Auto-population: Import from M28 Network Discovery scans. Import from CSV/NetBox export
• Network documentation: Auto-generate per-client IP allocation tables for M40 Documentation Engine

API Endpoints

GET    /api/v1/ipam/subnets/:clientId               -> Subnet[]
GET    /api/v1/ipam/addresses/:subnetId              -> IpAddress[]
POST   /api/v1/ipam/addresses                        -> Assign IP
GET    /api/v1/ipam/conflicts                        -> IpConflict[]
POST   /api/v1/ipam/import                           -> Import CSV/NetBox
GET    /api/v1/ipam/dhcp/:subnetId                   -> DhcpScopeView

Features

• Config drift detection: Monitor DNS records across all nameservers. Alert on unauthorized changes
• A/B testing: Stage DNS changes on dev/staging nameservers. Verify resolution before pushing to production
• Auto-rollback: If propagation monitoring detects failures (SERVFAIL, NXDOMAIN), auto-revert to last known good config
• Propagation monitoring: Multi-location resolver checks. Real-time propagation status dashboard with TTL countdown
• Change staging pipeline: Dev → Staging → Production. Approval gates between stages
• Recommendations: TTL optimization, CNAME vs A best practices, security headers (CAA, TLSA)
• DNS cache poisoning detection: Compare authoritative vs recursive resolver responses. Alert on discrepancies

API Endpoints

GET    /api/v1/dns-ops/zones/:domain                -> DnsZoneDetail
GET    /api/v1/dns-ops/drift/:domain                 -> DriftReport
POST   /api/v1/dns-ops/stage                         -> Stage DNS change
POST   /api/v1/dns-ops/promote/:changeId             -> Promote to production
POST   /api/v1/dns-ops/rollback/:changeId            -> Rollback change
GET    /api/v1/dns-ops/propagation/:domain           -> PropagationStatus
GET    /api/v1/dns-ops/recommendations/:domain       -> DnsRecommendation[]

Features

• Auto-generation: Pull data from M28 (network diagrams), M15/M75 (passwords), M37 (configs), M38 (IPAM), contacts, procedures → generate per-client documentation packages
• BookStack sync: Push generated docs to BookStack instance (already deployed on docker-host). Two-way sync
• Documentation-as-code: Version-controlled docs in Git. Rendered as searchable web pages
• Freshness scoring: Track when source data changed vs when doc was last updated. Flag stale documents
• Template library: Network overview, password register, backup procedure, DR plan, onboarding checklist
• Per-client workspace: Dedicated documentation area per client with search and access controls

API Endpoints

POST   /api/v1/docs/generate/:clientId              -> Generate docs
GET    /api/v1/docs/clients/:clientId                -> ClientDocIndex
POST   /api/v1/docs/sync/bookstack                   -> Sync to BookStack
GET    /api/v1/docs/freshness/:clientId              -> FreshnessReport
GET    /api/v1/docs/templates                        -> DocTemplate[]

Features

• Pattern detection: Backup failure + security alert + uptime down on same client within time window = correlated incident
• Alert deduplication: Suppress duplicate alerts from multiple sources for same issue
• Root cause suggestion: AI-powered: "3 alerts for Client X all stem from network outage at 2:30 AM"
• Severity escalation: Single alert = info, correlated cluster = warning/critical. Auto-escalate
• Alert timeline: Visual timeline per incident showing all related events across modules
• Noise reduction metrics: Track % of alerts suppressed. Show alert fatigue improvement over time

API Endpoints

GET    /api/v1/alerts/correlated                    -> CorrelatedIncident[]
GET    /api/v1/alerts/correlated/:id                 -> IncidentDetail
GET    /api/v1/alerts/timeline/:clientId              -> AlertTimeline
GET    /api/v1/alerts/stats                          -> AlertReductionStats
POST   /api/v1/alerts/acknowledge/:id                -> Acknowledge incident

Features

• Connection dashboard: Green/amber/red status per connector. Last successful sync time. Error count
• Auth monitoring: Token expiry countdown. Alert before expiry. Auto-refresh where possible
• Rate limit tracking: Current usage vs limit per API. Alert when approaching threshold
• Sync failure tracking: Failed sync history with error details. Auto-retry with exponential backoff
• Historical uptime: Per-integration uptime percentage. SLA tracking for your own connectivity
• API deprecation notices: Track vendor API version lifecycle. Alert on upcoming deprecations
• New Relic APM (optional): Application-level performance monitoring via NerdGraph GraphQL API. Distributed traces, error tracking, response time analytics for the Arete platform itself. Free tier: 100GB/month data ingest. Complements Prometheus/Grafana infrastructure monitoring

API Endpoints

GET    /api/v1/integrations/health                  -> IntegrationHealth[]
GET    /api/v1/integrations/:connectorId/history     -> SyncHistory
POST   /api/v1/integrations/:connectorId/test        -> Test connection
POST   /api/v1/integrations/:connectorId/retry       -> Retry failed sync
GET    /api/v1/integrations/uptime                   -> UptimeReport

Features

• Pipeline editor: YAML-based pipeline definitions for PowerShell, Python, Terraform automation
• Runner management: Execute pipelines on docker-host or client infrastructure. Queue and schedule
• Vulnerability scanning: GitHub Advanced Security / Trivy for container and dependency scanning
• Repo management: Track all Git repos, upstream provider status, dependency freshness, security alerts
• Deployment tracking: What was deployed where, when, by whom. Approval gates for production
• Templates: Best-practice pipelines for Intune config deployment, DNS changes, user provisioning

API Endpoints

GET    /api/v1/devops/pipelines                     -> Pipeline[]
POST   /api/v1/devops/pipelines/:id/run              -> Trigger pipeline
GET    /api/v1/devops/repos                          -> RepoInventory[]
GET    /api/v1/devops/vulnerabilities                -> VulnScanResult[]
GET    /api/v1/devops/deployments                    -> Deployment[]

Features

• Playwright screenshots: Scheduled screenshot capture with visual diff (pixel comparison)
• DOM diff: Show exactly what HTML/CSS changed between checks. Syntax-highlighted diff view
• Per-client monitoring: Track client sites, MSP sites, vendor portals. Configurable check frequency
• Alert triggers: Content changes, SSL changes, new scripts injected, meta tag modifications
• Screenshot history: Timeline view of all captured screenshots. Side-by-side comparison

API Endpoints

GET    /api/v1/website-tracker/sites                -> MonitoredSite[]
POST   /api/v1/website-tracker/sites                -> Add site
GET    /api/v1/website-tracker/changes/:siteId      -> ChangeHistory[]
GET    /api/v1/website-tracker/screenshots/:siteId  -> Screenshot[]
POST   /api/v1/website-tracker/check/:siteId        -> Trigger immediate check

Features

• Agreement builder: Templated T&Cs, SLA tier definitions, pricing schedules (per-device, per-user, flat, tiered)
• SLA tracking: Link SLA definitions to M7 ticket tracking. Auto-calculate compliance percentage
• Contract lifecycle: Draft → Active → Expiring → Renewed/Terminated. Visual pipeline view
• Expiry alerts: 30/60/90 day warnings. Auto-create renewal tasks
• Digital signatures: PDF signing via M10 Reporting Engine. Signature workflow with audit trail
• Revenue forecasting: Project MRR from active contracts. Feed M22 Profitability analysis

API Endpoints

GET    /api/v1/contracts                            -> Contract[]
POST   /api/v1/contracts                            -> Create contract
GET    /api/v1/contracts/:id/sla                     -> SlaComplianceReport
GET    /api/v1/contracts/expiring                    -> ExpiringContract[]
GET    /api/v1/contracts/revenue/forecast            -> RevenueForecast

Features

• Unified timeline: All communication events in chronological order. Filter by type, date, person
• Auto-capture: CW ticket notes, M27 portal activity, M365 email sync (opt-in), Teams meeting records
• Manual entries: Meeting notes, phone call logs, action items with due dates
• Action tracking: Create tasks from meeting notes. Link to M7 tickets. Track completion
• Last contact: "When did we last talk to Client X?" instant answer with communication gap alerts

API Endpoints

GET    /api/v1/comms/:clientId/timeline              -> TimelineEvent[]
POST   /api/v1/comms/:clientId/entries               -> Add manual entry
GET    /api/v1/comms/:clientId/actions               -> ActionItem[]
GET    /api/v1/comms/last-contact                    -> LastContactReport[]

Features

• Calendar view: Team-wide availability, job assignments, drag-and-drop scheduling
• Travel estimation: Google Maps API for drive time between sites. Optimize route for multi-site days
• Client site details: Address, parking, contact, access instructions (from M19 onboarding data)
• Job types: Install, maintenance, troubleshooting, audit. Link to M7 tickets and M25 change requests
• Time tracking: On-site hours auto-logged to CW time entries. Start/stop timer with GPS verification
• Mobile-first: iOS app priority for this module. Push notifications for schedule changes

API Endpoints

GET    /api/v1/dispatch/calendar                    -> TeamCalendar
POST   /api/v1/dispatch/jobs                         -> Create job
GET    /api/v1/dispatch/technicians/availability     -> TechAvailability[]
POST   /api/v1/dispatch/jobs/:id/checkin             -> Check in on-site
POST   /api/v1/dispatch/jobs/:id/checkout            -> Check out + log time

Features

• Scheduled rotation: Configurable schedule per account (30/60/90 day cycles)
• Target systems: Active Directory, M365 admin accounts, local admin (LAPS-style), application service accounts
• Rotation verification: Confirm new password works before committing. Rollback on failure
• Vault sync: Rotated passwords auto-update in M15/M75 vault with full history
• Compliance tracking: Last rotation date per account. Enforce max password age. Feed M20 evidence
• Failure alerting: Immediate alert if rotation fails. Auto-create M7 ticket for manual intervention

API Endpoints

GET    /api/v1/password-rotation/accounts            -> RotationAccount[]
POST   /api/v1/password-rotation/rotate/:accountId   -> Trigger rotation
GET    /api/v1/password-rotation/history/:accountId  -> RotationHistory
GET    /api/v1/password-rotation/compliance          -> ComplianceReport
PATCH  /api/v1/password-rotation/schedules/:id       -> Update schedule

Features

• Searchable library: Full-text search across all runbooks. Filter by technology, difficulty, category
• Decision trees: Interactive flowcharts for troubleshooting. Step-by-step with branching logic
• Version control: Change history with diff view. Rollback to previous versions
• Rich content: Screenshot/video embed support. Code blocks with syntax highlighting
• Difficulty ratings: Per-runbook estimated time and difficulty level
• BookStack sync: Push runbooks to BookStack for external access. Two-way sync
• Playbook linking: Link to related M21 Playbooks for automation of common steps

API Endpoints

GET    /api/v1/runbooks                             -> Runbook[]
GET    /api/v1/runbooks/:id                          -> RunbookDetail
GET    /api/v1/runbooks/:id/versions                 -> Version[]
POST   /api/v1/runbooks                              -> Create runbook
POST   /api/v1/runbooks/sync/bookstack               -> Sync to BookStack

Features

• Compliance checks: BitLocker enabled, antivirus current, OS updates installed, firewall enabled, screen lock configured, local admin password rotated
• Scoring: 0-100 per device, aggregated per client. Weighted by check criticality
• Policy definitions: Configurable requirements per client/tier. Different standards for different SLA levels
• Auto-remediation: Link non-compliant devices to M21 Playbooks. One-click fix for common issues
• Evidence feed: Feed M20 Compliance with Essential Eight / CIS evidence data
• Data sources: NinjaOne (device details), Intune (compliance policies), M3 Security (protection status)

API Endpoints

GET    /api/v1/endpoint-compliance/devices           -> DeviceCompliance[]
GET    /api/v1/endpoint-compliance/clients/:id       -> ClientComplianceScore
GET    /api/v1/endpoint-compliance/policies          -> CompliancePolicy[]
POST   /api/v1/endpoint-compliance/remediate/:deviceId -> Trigger remediation
GET    /api/v1/endpoint-compliance/evidence/:clientId -> ComplianceEvidence

Features

• Widget library: Charts (line, bar, pie, donut), tables, KPIs, gauges, maps, timelines, status indicators
• Drag-and-drop: Grid-based layout editor. Resize, reorder, configure per widget. Save/load layouts
• Data binding: Connect any widget to any module's API endpoint. Real-time refresh via WebSocket
• Role-based visibility: Admin sees revenue widgets, tech sees ticket widgets, client sees their health
• Shareable: Share dashboard layouts between users. Export as PDF/image for reports
• Client portal embedding: Embed custom dashboards in M27 Client Portal (scoped to client data)

API Endpoints

GET    /api/v1/dashboards                           -> Dashboard[]
POST   /api/v1/dashboards                           -> Create dashboard
GET    /api/v1/dashboards/:id                        -> DashboardLayout
PATCH  /api/v1/dashboards/:id                        -> Update layout
GET    /api/v1/dashboards/widgets/catalog             -> WidgetDefinition[]

Features

• Multi-channel: Email, SMS (M79), Slack, Teams, push (iOS), in-app notifications
• Per-user preferences: Choose channels per alert type. Quiet hours / DND scheduling
• Digest mode: Batch low-priority alerts into daily/weekly summary email
• Priority escalation: Critical alerts override quiet hours. Configurable escalation chains
• Notification history: Read/unread tracking. Mark all as read. Filter by module/priority
• Template engine: Customizable notification content per module. Variable substitution

API Endpoints

GET    /api/v1/notifications                        -> Notification[]
PATCH  /api/v1/notifications/:id/read                -> Mark read
GET    /api/v1/notifications/preferences              -> UserPreferences
PATCH  /api/v1/notifications/preferences              -> Update preferences
GET    /api/v1/notifications/digest/preview           -> DigestPreview

Features

• Immutable logging: Every platform action logged: who, what, when, from where (IP, device, session)
• Change history: Per-entity diff view showing before/after state for every modification
• Compliance evidence: Pre-formatted reports for SOC2 Type II and ISO 27001 auditors
• Retention policies: Configurable per tenant (90 days, 1 year, 7 years). Auto-archive old logs
• Search/filter: By user, action type, module, date range, entity. Full-text search in action details
• SIEM export: Stream audit events to external SIEM (Splunk, Sentinel, ELK) via webhook or syslog

API Endpoints

GET    /api/v1/audit-log                            -> AuditEvent[]
GET    /api/v1/audit-log/entity/:type/:id            -> EntityHistory
GET    /api/v1/audit-log/users/:userId               -> UserActivityLog
GET    /api/v1/audit-log/export                      -> Export (CSV/JSON/SIEM)
GET    /api/v1/audit-log/compliance-report            -> ComplianceReport

Features

• External asset discovery: Public IPs, open ports, exposed services, SSL certificates per client
• Risk scoring: Per-asset risk based on exposed services, known vulns, SSL grade, open ports
• Continuous monitoring: Detect changes: new ports opened, services exposed, certs expired
• Subdomain enumeration: DNS brute-force + Certificate Transparency log analysis
• Dark web correlation: Cross-reference M14 Breach & Dark Web findings with exposed services
• Internal vs external gap: Compare M50 Endpoint Compliance (internal) vs attack surface (external)

API Endpoints

GET    /api/v1/attack-surface/:clientId              -> ExternalAsset[]
GET    /api/v1/attack-surface/:clientId/score        -> RiskScore
POST   /api/v1/attack-surface/:clientId/scan         -> Trigger scan
GET    /api/v1/attack-surface/:clientId/changes      -> ChangeHistory[]
GET    /api/v1/attack-surface/:clientId/subdomains   -> Subdomain[]

Features

• Campaign management: Create, schedule, monitor phishing simulation campaigns
• Template library: Credential harvest, malware link, invoice fraud, CEO impersonation, IT support
• User tracking: Click rates, report rates, per-user risk scoring with trend over time
• Training assignment: Auto-assign training modules when users fail. Track completion
• Sophos Central integration: Import results from Sophos-managed phishing campaigns via Sophos API
• M365 Attack Simulation: Sync results from Microsoft's built-in phishing simulation training
• usecure integration: Import campaign results and user risk scores from usecure platform
• Unified reporting: Combined view across Sophos, M365, usecure, and native campaigns. Client-facing reports via M32 QBR

Connectors

API Endpoints

GET    /api/v1/phishing/campaigns                   -> Campaign[]
POST   /api/v1/phishing/campaigns                   -> Create campaign
GET    /api/v1/phishing/campaigns/:id/results        -> CampaignResult
GET    /api/v1/phishing/users/:clientId               -> UserRiskScore[]
POST   /api/v1/phishing/sync                         -> Sync external platforms
GET    /api/v1/phishing/reports/:clientId              -> UnifiedPhishingReport

Features

• Templates: 5 Whys analysis, chronological timeline builder, blameless retrospective format
• Auto-populate: Pull timeline from M41 Alert Correlation and M7 ticket history. Pre-fill with affected clients, duration, SLA breach info
• Impact assessment: Affected clients, downtime duration, SLA breaches, estimated financial cost
• Action items: Track remediation tasks with owner, due date. Feed into M7 tickets
• Lessons learned: Searchable database of past incidents and what was learned
• Pattern detection: Identify recurring incident types. Flag systemic issues
• Client sharing: Share sanitized post-mortems with affected clients via M27 Portal

API Endpoints

GET    /api/v1/postmortems                          -> PostMortem[]
POST   /api/v1/postmortems                          -> Create post-mortem
GET    /api/v1/postmortems/:id                       -> PostMortemDetail
GET    /api/v1/postmortems/lessons                   -> LessonLearned[]
GET    /api/v1/postmortems/patterns                  -> RecurringPattern[]

Features

• Agreement vs actual: Compare CW agreement line items (devices, users, mailboxes) vs actual counts from NinjaOne + Graph API
• Revenue leakage: Flag unbilled devices, users exceeding agreement limits. Calculate lost revenue
• Discrepancy dashboard: Per-client view of all billing discrepancies. Sort by impact ($)
• Auto-sync: Device counts from NinjaOne, user/mailbox counts from M365 Graph API. Daily refresh
• History tracking: Track reconciliation over time. Show improvement trends
• Adjustment recommendations: Generate specific billing adjustment suggestions with dollar amounts

API Endpoints

GET    /api/v1/billing/reconciliation                -> ClientReconciliation[]
GET    /api/v1/billing/reconciliation/:clientId      -> ReconciliationDetail
GET    /api/v1/billing/leakage                       -> LeakageSummary
POST   /api/v1/billing/sync                          -> Trigger count sync
GET    /api/v1/billing/adjustments/:clientId          -> AdjustmentRecommendation[]

Supported Sources

Features

• Field mapping: Map source fields to Arete schema. Auto-detect common mappings
• Validation: Preview imported data before committing. Show conflicts and warnings
• Incremental sync: Run migration in stages. Resume from where you left off
• Rollback: Undo last import batch. Full audit trail of imported records
• Export: Full platform data export for compliance/portability (reverse migration)

API Endpoints

POST   /api/v1/migration/import                     -> Start import
GET    /api/v1/migration/jobs                        -> MigrationJob[]
GET    /api/v1/migration/jobs/:id/preview             -> ImportPreview
POST   /api/v1/migration/jobs/:id/commit              -> Commit import
POST   /api/v1/migration/jobs/:id/rollback            -> Rollback import
POST   /api/v1/migration/export                      -> Full data export

Features

• Context-aware drafts: Generate emails from ticket details, alert context, backup reports, security summaries
• Tone presets: Professional, urgent, casual, executive summary. Client-specific communication style
• Auto-attach data: Include relevant reports, charts, compliance summaries as attachments
• Review workflow: Draft → Tech review → Approve → Send. Never auto-send without human review
• M365 integration: Send via Outlook using Graph API. Track delivery and read receipts
• Template library: Common email types: outage notification, maintenance complete, monthly report, onboarding welcome

API Endpoints

POST   /api/v1/email-drafts/generate                 -> DraftEmail
GET    /api/v1/email-drafts                          -> Draft[]
PATCH  /api/v1/email-drafts/:id                      -> Edit draft
POST   /api/v1/email-drafts/:id/send                 -> Send via M365
GET    /api/v1/email-drafts/templates                -> EmailTemplate[]

Data Sources

Features

• AI clustering: Group related activities into logical work blocks. "9:00-10:30 = Working on Client X network issue"
• Gap detection: Highlight time periods with no tracked activity. Prompt for manual entry
• Confidence scoring: High = multiple sources agree, Medium = single source, Low = inferred from gaps
• Manual adjustment: Review/edit UI before submission. Split, merge, re-classify entries
• CW export: Export to ConnectWise time entries or CSV. Map to agreement/project/ticket
• Manager approval: Submission workflow with manager review and approve/reject

API Endpoints

GET    /api/v1/timesheets/:userId/generate           -> GeneratedTimesheet
GET    /api/v1/timesheets/:userId/day/:date          -> DayDetail
PATCH  /api/v1/timesheets/:userId/entries/:id         -> Adjust entry
POST   /api/v1/timesheets/:userId/submit              -> Submit for approval
POST   /api/v1/timesheets/export/cw                   -> Export to ConnectWise

Feed Sources

Features

• AI-summarized briefings: Daily/weekly digests with natural language summaries of relevant security news
• Client relevance scoring: Cross-reference CVEs with M8 asset inventory. Score which clients are affected
• Action items: CVE detected → Check if patched in M23 → Alert if not → Create M7 ticket
• Compliance calendar: Track regulatory deadlines, update cycles, audit dates
• Weekly digest: Auto-email security digest to stakeholders with risk-rated items

API Endpoints

GET    /api/v1/security-feed                        -> SecurityAlert[]
GET    /api/v1/security-feed/cves                    -> CveAlert[]
GET    /api/v1/security-feed/cves/:cveId/affected     -> AffectedClient[]
GET    /api/v1/security-feed/compliance-calendar      -> ComplianceEvent[]
GET    /api/v1/security-feed/digest                   -> WeeklyDigest

Supported Vendors

Features

• Firmware comparison: Current vs latest vs vendor-recommended "stable" branch per device
• Critical alert priority: Flag devices with known exploited CVEs (cross-ref M61 CISA KEV)
• Patch urgency scoring: CVSS score × asset criticality × exposure (internal vs external facing)
• Vendor advisory aggregation: API/scrape advisories from WatchGuard, Fortinet PSIRT, Cisco PSIRT, HPE, Ubiquiti
• Auto-discovery: Pull inventory from NinjaOne, M28 Network Discovery, UniFi Controller, FortiManager
• Change management: Integrate with M25 for firmware update RFCs and maintenance windows
• Compliance evidence: Track firmware patch compliance for E8 (Patch Applications, Patch OS) and CIS
• Dashboard: Fleet-wide firmware age distribution, devices running vulnerable firmware, devices past EOL

API Endpoints

GET    /api/v1/firmware/devices                      -> FirmwareDevice[]
GET    /api/v1/firmware/devices/:id                   -> FirmwareDetail
GET    /api/v1/firmware/vulnerable                    -> VulnerableDevice[]
GET    /api/v1/firmware/advisories                    -> VendorAdvisory[]
GET    /api/v1/firmware/compliance/:clientId           -> FirmwareCompliance
POST   /api/v1/firmware/sync                          -> Trigger vendor sync

Score Components

Features

• Traffic light dashboard: All clients at a glance — green (>80), amber (60-80), red (<60)
• Drill-down: Click score to see contributing factors with per-module breakdown
• Trending: Quarterly comparison showing improvement or degradation per client
• Auto-flag: Alert when any client drops below configurable threshold
• QBR integration: Feed M32 QBR with health trend data and executive summary

API Endpoints

GET    /api/v1/health-score/clients                  -> ClientHealthScore[]
GET    /api/v1/health-score/clients/:id               -> HealthScoreDetail
GET    /api/v1/health-score/clients/:id/trend         -> ScoreTrend[]
GET    /api/v1/health-score/alerts                    -> HealthAlert[]

Features

• Storage forecasting: Disk growth trend analysis. Predict when drives fill up per device/client
• Mailbox growth: M365 mailbox size tracking with projection. Alert on approaching quota
• License consumption: User count growth projections. Predict when current license count is exhausted
• Azure resource forecasting: Compute, storage, networking utilization trends
• Proactive alerts: "Client X will exceed 1TB mailbox in 3 months" style warnings
• Upgrade recommendations: Auto-generate hardware/service upgrade proposals with cost estimates

API Endpoints

GET    /api/v1/capacity/forecasts/:clientId           -> CapacityForecast[]
GET    /api/v1/capacity/storage/:clientId              -> StorageForecast
GET    /api/v1/capacity/licenses/:clientId             -> LicenseForecast
GET    /api/v1/capacity/alerts                        -> CapacityAlert[]
GET    /api/v1/capacity/recommendations/:clientId      -> UpgradeRecommendation[]

Features

• Data warehouse: Unified schema aggregating data from all 75 modules. Materialized views for fast queries
• Query builder: SQL-like interface for non-technical users. Saved queries, parameterized reports
• Visualizations: Power BI-style interactive charts, heatmaps, pivot tables, scatter plots
• Cross-module correlation: "Clients with low backup scores also have 2.3x more tickets" type insights
• Scheduled delivery: Email, Slack, Teams delivery of recurring reports
• Pre-built templates: Revenue trends, ticket patterns, security trends, client health over time

API Endpoints

POST   /api/v1/bi/query                             -> Execute query
GET    /api/v1/bi/saved-queries                      -> SavedQuery[]
GET    /api/v1/bi/templates                          -> AnalyticsTemplate[]
POST   /api/v1/bi/schedule                           -> Schedule report delivery
GET    /api/v1/bi/insights                           -> AiInsight[]

Features

• Post-ticket CSAT: Auto-send survey on ticket closure. 1-5 star rating with optional comment
• Quarterly NPS: 0-10 scale NPS campaigns. Calculate Promoter/Passive/Detractor distribution
• Per-technician ratings: Track individual tech satisfaction scores with trend lines
• Negative follow-up: Auto-alert manager on scores < 3 stars. Create follow-up task
• Response tracking: Response rate monitoring. Nudge for non-responses
• QBR integration: Feed satisfaction data into M32 QBR and M22 Profitability reports

API Endpoints

GET    /api/v1/surveys/responses/:clientId            -> SurveyResponse[]
POST   /api/v1/surveys/campaigns                     -> Create NPS campaign
GET    /api/v1/surveys/nps/:clientId                  -> NpsScore
GET    /api/v1/surveys/technicians                    -> TechSatisfaction[]
GET    /api/v1/surveys/trends/:clientId               -> SatisfactionTrend

Features

• Auto-populate questionnaires: Pull real data: MFA status (M9), backup verification (M2/M69), patch compliance (M23/M50), EDR coverage (M3), password policies (M48), training (M34)
• Insurer templates: Pre-built question sets for Chubb, QBE, Allianz, Zurich. Customizable
• Gap analysis: Compare current state vs insurer requirements. Highlight deficiencies with remediation guidance
• Evidence snapshots: Timestamped compliance evidence for claims support
• Readiness reports: Per-client readiness report with confidence scores per requirement
• Policy tracking: Renewal dates, premium trends, coverage limits per client

API Endpoints

GET    /api/v1/insurance/readiness/:clientId          -> ReadinessReport
GET    /api/v1/insurance/questionnaires                -> QuestionnaireTemplate[]
POST   /api/v1/insurance/questionnaires/:id/fill       -> AutoFillAnswers
GET    /api/v1/insurance/gaps/:clientId                -> InsuranceGap[]
GET    /api/v1/insurance/evidence/:clientId             -> EvidencePackage

Features

• Checklist workflow: Remove NinjaOne agent → Export data → Archive docs (M40) → Revoke M365 licenses → Transfer DNS/domains → Final billing (M57) → Remove monitoring (M6, M3)
• Data export: Generate complete client data package (passwords, configs, documentation, tickets)
• Compliance evidence: Timestamped proof of clean separation. Data retention policy enforcement
• Sign-off gates: Require approvals at key stages. Manager sign-off on data destruction

API Endpoints

POST   /api/v1/offboarding/workflows                 -> Create offboarding
GET    /api/v1/offboarding/workflows/:id              -> OffboardingStatus
PATCH  /api/v1/offboarding/workflows/:id/steps/:n     -> Complete step
POST   /api/v1/offboarding/workflows/:id/export       -> Generate data package

Features

• Automated restore tests: Schedule per client (monthly/quarterly). Auto-trigger from latest backup
• Integrity verification: Checksum validation, file sampling, boot verification (screenshot capture)
• Test types: File-level, VM-level, application-level (M365 mailbox, SharePoint site)
• Evidence trail: Timestamped results with screenshots. Feed M24 DR and M67 Insurance evidence
• Auto-ticket: Create M7 ticket on restore test failure. Track remediation
• Restorability scoring: Confidence score per backup set. Feed M2 Backup Intelligence

API Endpoints

GET    /api/v1/backup-testing/tests                  -> RestoreTest[]
POST   /api/v1/backup-testing/tests                  -> Schedule test
GET    /api/v1/backup-testing/results/:testId         -> TestResult
GET    /api/v1/backup-testing/scores/:clientId        -> RestorabilityScore

Features

• Unified view: All active remote sessions across all tools in one dashboard
• Session logging: Who accessed what, when, for how long. Compliance-ready audit trail
• Access policies: Restrict which technicians can access which clients. Manager approval for sensitive systems
• Emergency kill switch: Terminate any session immediately from the dashboard
• Duration tracking: Idle timeout alerts. Session time limits. Cost tracking per session

API Endpoints

GET    /api/v1/sessions/active                       -> ActiveSession[]
GET    /api/v1/sessions/history                       -> SessionHistory[]
POST   /api/v1/sessions/:id/terminate                 -> Kill session
GET    /api/v1/sessions/policies                      -> AccessPolicy[]

Features

• Device inventory: Printers, cameras, sensors, UPS, signage per client/site
• UPS monitoring: Battery health, load percentage, runtime remaining (via SNMP)
• Environmental: Temperature, humidity sensors for server rooms. Alert on out-of-range
• Printer consumables: Toner levels, page counts, maintenance kit status
• Firmware updates: Track IoT device firmware versions. Alert on updates available
• Network segmentation: Recommend VLAN isolation for IoT devices (security best practice)

API Endpoints

GET    /api/v1/iot/devices/:clientId                  -> IoTDevice[]
GET    /api/v1/iot/ups/:deviceId                      -> UpsHealth
GET    /api/v1/iot/environmental/:siteId               -> EnvironmentalReading[]
GET    /api/v1/iot/printers/:clientId                  -> PrinterStatus[]

Features

• Single pane of glass: All cloud resources across all providers in one view
• Security audit: NSG/security group review, public IP exposure, storage access policies
• Cost allocation: Tag compliance, cost by department/project, chargeback reports
• Right-sizing: Identify over-provisioned resources. Savings recommendations
• Reserved instances: RI/savings plan coverage analysis. Purchase recommendations

API Endpoints

GET    /api/v1/cloud/resources/:clientId              -> CloudResource[]
GET    /api/v1/cloud/security/:clientId               -> SecurityAudit
GET    /api/v1/cloud/optimization/:clientId            -> OptimizationRecommendation[]
GET    /api/v1/cloud/costs/:clientId/breakdown         -> CostBreakdown

Features

• CSP/GDAP: Track GDAP role assignments with expiry. CSP subscription management. Ensure MSP is partner of record for all eligible tenants
• Solutions Partner: Track points/skilling progress per competency. Identify gaps in tenant associations and certifications
• Config drift: Monitor partner-managed tenants for unexpected CA policy changes, license modifications, admin role changes
• Unified M365 Health: Aggregate Service Health across ALL tenants. Per-tenant health dashboard. Incident correlation
• License optimization: Detect unused licenses (no sign-in 90+ days). Suggest tier changes (E3 ↔ E5 ↔ F1). Cost impact analysis
• Direct billing detection: Flag clients not billing Azure subs through CSP. Revenue opportunity identification

API Endpoints

GET    /api/v1/partner/tenants                       -> PartnerTenant[]
GET    /api/v1/partner/gdap/:tenantId                 -> GdapAssignment[]
GET    /api/v1/partner/designations                   -> PartnerDesignation[]
GET    /api/v1/partner/drift/:tenantId                -> ConfigDrift[]
GET    /api/v1/partner/health                         -> TenantHealth[]
GET    /api/v1/partner/licensing/:tenantId             -> LicenseOptimization

Diagram Types

Features

• Auto-refresh: Diagrams update when source data syncs. Never stale
• History: View diagram snapshots over time. See how infrastructure evolved
• Export: SVG, PNG, PDF, Visio-compatible (.vsdx), Mermaid markdown
• Embed: Auto-insert into M40 Documentation Engine per client
• Technology: D3.js for force-directed graphs, Mermaid.js for structured diagrams

API Endpoints

GET    /api/v1/diagrams/:clientId                     -> DiagramIndex
GET    /api/v1/diagrams/:clientId/:type               -> DiagramData
GET    /api/v1/diagrams/:clientId/:type/export/:fmt   -> Export (svg/png/pdf/vsdx)
GET    /api/v1/diagrams/:clientId/history              -> DiagramHistory
POST   /api/v1/diagrams/:clientId/refresh              -> Force refresh

Features

• Organization management: Per-client collections. Shared vault for tech teams. Access controls
• HIBP breach check: Check all stored passwords against HaveIBeenPwned database. Alert on compromised
• Password strength audit: Reuse detection, weak password flagging, age tracking
• Emergency access: Break-glass procedures with audit trail. Time-delayed access for emergencies
• Rotation sync: M48 Password Rotation auto-updates vault entries on rotation
• Client portal access: Scoped vault access via M27 Client Portal (clients see only their passwords)
• Mobile compatibility: Standard Bitwarden mobile/desktop clients work with Vaulwarden instance

API Endpoints

GET    /api/v1/vault/organizations                    -> Organization[]
GET    /api/v1/vault/collections/:orgId               -> Collection[]
POST   /api/v1/vault/breach-check                     -> BreachCheckResult
GET    /api/v1/vault/health/:orgId                    -> VaultHealthReport

Features

• SMTP testing: Periodic connectivity tests, STARTTLS verification, certificate validation, open relay detection
• Blacklist monitoring: Check IPs/domains against 50+ blacklists (Spamhaus, Barracuda, SURBL). Real-time alerting on new listings
• Delisting automation: Auto-generate delisting request links. Track delisting progress
• DNS zone watcher: Monitor MX, SPF, DKIM, DMARC records for unauthorized changes. DNSSEC validation
• DNS cache poisoning: Compare authoritative vs recursive resolver responses. Alert on discrepancies
• Cloud storage monitoring: S3 bucket health, public exposure detection, lifecycle policy compliance

API Endpoints

GET    /api/v1/email-infra/smtp/:domain               -> SmtpTestResult
GET    /api/v1/email-infra/blacklists/:ip              -> BlacklistStatus
GET    /api/v1/email-infra/zones/:domain               -> ZoneHealth
GET    /api/v1/email-infra/storage                     -> StorageHealth[]
POST   /api/v1/email-infra/smtp/:domain/test           -> Run SMTP test

WPScan API v3 Integration

WPScan API Endpoints Used

Response fields: id, title, created_at, updated_at, published_date, vuln_type (sqli, xss, rce, lfi, etc.), references (url, cve, wpvulndb), fixed_in (version). Enterprise-only fields: description, poc (proof of concept).

Features

• Site registration: Add WordPress sites by URL. Auto-detect WP version, installed plugins (via /wp-json or HTML fingerprinting), and active theme. Store in WordPressSite model
• Scheduled scanning: Daily scan queue with smart budgeting. Sites rotate if total plugins+themes exceed 25/day limit. Priority scanning for sites with previously detected vulns
• API quota dashboard: Real-time display of remaining daily API calls via /status endpoint. Visual gauge showing used/remaining. Alert when quota < 5 remaining
• Vulnerability dashboard: Per-site vulnerability cards with severity badges (critical/high/medium/low based on vuln_type). Sortable by severity, site, plugin name. Click to expand: CVE details, affected versions, fixed_in version, references
• Plugin/theme audit: Side-by-side: installed version vs. latest vs. fixed_in. Traffic light indicators (green = current + no vulns, amber = outdated, red = vulnerable)
• Abandoned plugin detection: Flag plugins with no updates in 12+ months (cross-reference wordpress.org API for last_updated date). Recommend alternatives
• Auto-remediation suggestions: Link each vulnerability to its fixed_in version. One-click "Create update ticket" for M7 Tickets with pre-populated details
• Page change detection: Content changes in CMS-managed pages. Detect defacement, SEO spam injection, unauthorized script injection. DOM diff view
• Admin user audit: Track WP admin account creation/changes via WP REST API (/wp/v2/users). Alert on new admin accounts or role elevation
• Multi-CMS support: WordPress (primary, WPScan-powered), Joomla (version fingerprint), Drupal (changelog.txt/CHANGELOG.md detection). Unified vulnerability view across CMS types
• Attack surface feed: Push discovered WordPress vulns to M54 Attack Surface Monitor for external risk scoring
• Security news correlation: Cross-reference M61 CVE feed with installed WordPress plugins across all clients. Proactive alert: "CVE-2026-XXXX affects plugin X installed on 3 client sites"

Frontend Pages

• CMS Dashboard (/cms): Overview cards — total sites monitored, total vulns (by severity), sites needing attention, API quota gauge. Pie chart: vuln distribution by type. Bar chart: vulns per client
• Site List (/cms/sites): TanStack Table — URL, CMS type, version, plugin count, vuln count, last scanned, health badge. Filters: by client, CMS type, has-vulns. Bulk scan action
• Site Detail (/cms/sites/:id): Tabbed view — Overview (version + health score), Plugins (table with version/vuln status per plugin), Themes, Vulnerabilities (timeline of discovered vulns), Changes (content change history with diff), Admin Users
• Vulnerability Feed (/cms/vulnerabilities): Chronological feed of all discovered vulns across all sites. Filter by severity, CMS, client. Click to drill into affected site. "Create ticket" quick action per vuln
• Settings (/settings/integrations/wpscan): API key input (masked), quota display, scan schedule configuration, notification preferences

Rate Limit Budget Planner

The connector implements a daily budget planner to maximize coverage within 25 requests/day:

// Budget calculation per site
const budget = (site) => 1 (core) + site.plugins.length + site.themes.length;

// Example: Site with 15 plugins + 2 themes = 18 requests
// Remaining budget: 25 - 18 = 7 requests for other sites

// Strategy:
// 1. Check /status first (free, doesn't count)
// 2. Prioritize sites with known vulnerabilities
// 3. Rotate remaining sites across days
// 4. Cache results for 24h (don't re-check same plugin twice per day)
// 5. Skip plugins already checked today (deduplicate across sites)

API Endpoints

GET    /api/v1/cms/sites                             -> WordPressSite[]
POST   /api/v1/cms/sites                             -> Add site to monitor
GET    /api/v1/cms/sites/:id                          -> WordPressSite (detail)
DELETE /api/v1/cms/sites/:id                          -> Remove site
GET    /api/v1/cms/sites/:id/plugins                  -> PluginStatus[]
GET    /api/v1/cms/sites/:id/themes                   -> ThemeStatus[]
GET    /api/v1/cms/sites/:id/vulnerabilities           -> Vulnerability[]
GET    /api/v1/cms/sites/:id/changes                  -> ContentChange[]
GET    /api/v1/cms/sites/:id/admins                   -> WpAdmin[]
POST   /api/v1/cms/sites/:id/scan                     -> Trigger manual scan
GET    /api/v1/cms/vulnerabilities                    -> AllVulnerabilities[] (cross-site)
GET    /api/v1/cms/vulnerabilities/:id                 -> VulnerabilityDetail
POST   /api/v1/cms/vulnerabilities/:id/create-ticket   -> Create M7 ticket from vuln
GET    /api/v1/cms/quota                              -> WPScan API quota status
GET    /api/v1/cms/stats                              -> Dashboard stats

Connector: WPScan

Features

• Risk scoring: Automated security posture assessment per vendor (SSL, email auth, open ports, breach history)
• Questionnaires: Send, track, score security questionnaire responses. Customizable templates
• Continuous monitoring: Ongoing posture checks. Alert on degradation (cert expiry, new vulns)
• Vendor inventory: Per-client: which vendors handle what data, what certifications they hold
• Risk matrix: Likelihood × Impact scoring. Visual risk heatmap
• Regulatory compliance: APRA CPS 234 (third-party risk), Privacy Act requirements tracking
• Insurance feed: Provide third-party risk evidence to M67 Cyber Insurance module

API Endpoints

GET    /api/v1/vendor-risk/vendors                    -> VendorRisk[]
GET    /api/v1/vendor-risk/vendors/:id/score           -> RiskScore
POST   /api/v1/vendor-risk/questionnaires              -> Send questionnaire
GET    /api/v1/vendor-risk/matrix/:clientId             -> RiskMatrix
GET    /api/v1/vendor-risk/compliance                  -> ComplianceReport

Features

• SMS sending: Template-based messages (outage, maintenance, password reset, appointment reminder)
• Bulk campaigns: Mass SMS for planned maintenance notifications. Delivery tracking
• Two-way SMS: Receive replies, route to M7 tickets. Auto-responses for common queries
• Automation triggers: Link to any module alert. Critical backup failure → SMS to client. SLA breach → SMS to tech
• Provider flexibility: Twilio (international) or MessageMedia (Australian optimized). Failover between providers
• Cost tracking: SMS spend per client/month. Budget alerts. Feed M22 Profitability
• Compliance: Opt-in/opt-out management per contact (Spam Act 2003). DNC list integration

API Endpoints

POST   /api/v1/sms/send                              -> Send SMS
POST   /api/v1/sms/campaigns                         -> Create bulk campaign
GET    /api/v1/sms/history                            -> SmsHistory[]
GET    /api/v1/sms/costs                              -> SmsCostReport
GET    /api/v1/sms/templates                          -> SmsTemplate[]

Features

• Password sharing: Generate time-limited links. Set expiry (hours/days), max views, optional passphrase
• File sharing: Encrypted file transfer with same limits. Client-side encryption before upload
• Auto-destroy: Content destroyed after expiry or view limit reached. Immutable deletion
• Audit trail: Who created, who viewed, when expired. Feed M53 Platform Audit Log
• Branding: Client-facing sharing page with MSP branding via M27 Client Portal
• Vault integration: One-click "share securely" from M15/M75 vault. Pre-populate from vault entries
• Onboarding integration: Share initial credentials during M19 Client Onboarding workflow

API Endpoints

POST   /api/v1/sharing/passwords                     -> Create password share
POST   /api/v1/sharing/files                         -> Create file share
GET    /api/v1/sharing/:token                        -> Retrieve (public endpoint)
GET    /api/v1/sharing/history                        -> ShareHistory[]
DELETE /api/v1/sharing/:id                            -> Manually destroy

Features

• Component health: Per-module/service health check with logo/icon. Green/amber/red status indicators
• Infrastructure monitors: PostgreSQL connection pool, Redis memory/connections, K8s pod health, BullMQ queue depth, API response times
• API health: Per-connector health from M42 Integration Health. Token expiry, rate limit status, last successful sync
• Historical uptime: 90-day uptime chart per component. Response time graphs (P50/P95/P99)
• Incident tracking: Log incidents with timeline, impact assessment, resolution. Auto-create from M41 Alert Correlation
• Maintenance windows: Schedule maintenance with advance notification. Auto-update status page
• Public status page: Branded public-facing page (like status.arete.dev) with real-time status. RSS/Atom feed for subscribers
• Alerting: Push/email/SMS notifications on status changes via M52 Notification Center

API Endpoints

GET    /api/v1/status/components                     -> ComponentHealth[]
GET    /api/v1/status/uptime                          -> UptimeHistory[]
GET    /api/v1/status/incidents                       -> StatusIncident[]
POST   /api/v1/status/incidents                       -> Create incident
POST   /api/v1/status/maintenance                     -> Schedule maintenance
GET    /api/v1/status/public                          -> PublicStatusPage (unauthenticated)