---
module: agent.aria-signals
title: ARIA Security Signals — ATM threat-signal collector
tab: Claude
order: 40
audience: dev
---

> **Internal · agent reference.** Terse. Confirmed against `hiveops-module-aria-signals` source (`com.hiveops.aria`) 2026-07-01.

## Identity
- Module name (`AgentModule.getName()`): **`aria-signals`**
- Maven artifact: **`hiveops-module-aria-signals`** (own version `1.0.0`; parent `hiveops-agent-parent` `4.4.3`)
- Entry class: `com.hiveops.aria.AriaSignalModule` (SPI file: `META-INF/services/com.hiveops.core.module.AgentModule`)
- Other classes: `AriaSignalCollector`, `AriaPostureReporter`, `AriaHttpClient`; DTOs `AriaIngestRequest`, `AriaSignalItem`, `AriaPostureReportDto`
- Log package (`getLogPackage()`): `com.hiveops.aria` → `logs/modules/aria-signals.log`
- Drop-in JAR: `modules/hiveops-module-aria-signals.jar` (all deps `provided`; not in fat JAR)
- **Disabled by default.** No fleet-task kind; passive scheduled collector.

## Config property keys (all in `hiveops.properties`)
| Key | Default | Notes |
|---|---|---|
| `aria.signals.enabled` | `false` | master switch |
| `aria.endpoint` | *(none, required)* | ARIA base URL; blank → module inactive |
| `aria.service.secret` | `""` | sent as `X-Service-Secret` header |
| `aria.signals.poll.interval.sec` | `60` | event/staging poll |
| `aria.posture.report.interval.sec` | `86400` | posture report (24h) |
| `aria.signals.batch.size` | `50` | `wevtutil /c:` cap per poll |
| `aria.gold.image.hash` | *(none)* | enables image-drift check when set |
| `aria.image.path` | *(none)* | file hashed (SHA-256) vs gold hash |
| `aria.ssl.skip.verify` | `false` | installs **JVM-wide** trust-all SSL |
| `aria.device.id` | *(none)* | numeric; else omitted from reports |
| `agent.institution.key` → `incident.institution.key` | *(none)* | institution key |

- `isEnabled()` == true only when `aria.signals.enabled=true` AND `aria.endpoint` non-blank.
- `deviceAgentId` = `ModuleContext.getAtmName()`. No dedicated `aria.*` interval for staging scan (shares `aria.signals.poll.interval.sec`).

## Signal strings emitted (`AriaSignalItem.signalKey` / `.eventType`)
| signalKey | eventType | Source |
|---|---|---|
| `"1102"`,`"4719"`,`"6416"`,`"2003"`,`"4663"`,`"4688"`,`"4697"` | `OS_EVENT` | Windows Security Event Log (`wevtutil`) |
| `IOC_FILENAME_MATCH` | `FILE_SYSTEM` | suspicious filename in a staging dir |
| `SUSPICIOUS_DIRECTORY` | `FILE_SYSTEM` | staging dir contains ANY file |

- Monitored Security Event IDs: `1102, 4719, 6416, 2003, 4663, 4688, 4697` (`SECURITY_EVENT_IDS`).
- Staging dirs (`STAGING_DIRS`): `C:/Temp/bin`, `C:/Windows/Temp/s`, `C:/ProgramData/s`, `C:/ProgramData/Microsoft/Wms`, `C:/Windows/system32/bin`.
- Suspicious filenames (case-insensitive): `Newage.exe`, `Color.exe`, `sdelete.exe`, `atmapp.exe`, `mainclientd.exe`, `ATMContent.exe`.
- Posture DTO fields: `diskEncryptionEnabled`, `auditPolicyCompliant`, `softwareWhitelistEnabled`, `osVersion`, `osEolStatus` (`SUPPORTED|EOL|UNKNOWN`), `goldImageHash`, `currentImageHash` (`sha256:<hex>`).

## HTTP endpoints (agent → ARIA backend, DIRECT)
| Call | Method + path (relative to `aria.endpoint`) |
|---|---|
| Events | `POST /api/aria/ingest/events` (`AriaIngestRequest`) |
| Posture | `POST /api/aria/posture/report` (`AriaPostureReportDto`) |
- Header: `X-Service-Secret: <aria.service.secret>`. Timeouts: connect 10s / read 15s. Non-2xx logged as warning, **no retry**.
- Does **NOT** go through agent-proxy/incident; does **NOT** use `agent.auth.token` or `FleetTask`/`FileUploadClient`.

## Posture check commands (Windows, raw `ProcessBuilder`)
- BitLocker: `manage-bde -status C:` → true if output contains "protection on"
- Audit policy: `auditpol /get /subcategory:"Audit Policy Change"` → true unless "no auditing"
- Whitelisting: `sadmin status` → "solid"; fallback `reg query HKLM\...\SrpV2\Exe /v EnforcementMode` → contains `0x1`
- Each returns `null` on failure; `@JsonInclude(NON_NULL)` drops nulls.

## Deployment
- Enable: `CONFIG_UPDATE` fleet task setting `aria.signals.enabled=true` + `aria.endpoint` (+ secret), then agent restart.
- Retrofit missing JAR: `INSTALL_MODULE` fleet task (drops JAR into `modules/`, restarts agent) or full agent update.
- Disable: `aria.signals.enabled=false` OR add `aria-signals` to `modules.disabled`.

## Gotchas
- **First collector tick only anchors the log** (records max `EventRecordID`, sends nothing). First real events arrive on the 2nd tick (after `aria.signals.poll.interval.sec`). Posture report fires immediately on start.
- **Windows-only in practice:** event-log poll + staging scan produce nothing on Linux. Posture report runs anywhere but only OS/EOL + image-hash fields populate off-Windows (BitLocker/audit/whitelist are Windows-guarded).
- `SUSPICIOUS_DIRECTORY` fires if the staging dir holds **any** file, not just a suspicious one → noisy.
- Record bookmark (`lastSecurityRecordId`) advances **before** the POST; a failed send loses those events (no re-queue).
- `aria.ssl.skip.verify=true` installs a trust-all `SSLContext` via `HttpsURLConnection.setDefault*` — affects the **entire JVM**, not just ARIA calls.
- XML is parsed by hand-rolled string scanning (`extractTag`/`extractAttr`), not a real XML parser.
- No `PlatformService`/`SystemCommands` usage — inline `os.name` + `ProcessBuilder`.

## Do NOT
- Do NOT expect `EventType` journal/incident events (`CARD_READER_FAIL`, `IAT_*`, etc.) — this module emits ARIA `signalKey`/`eventType` (`OS_EVENT`/`FILE_SYSTEM`) only, direct to ARIA.
- Do NOT look for these calls in agent-proxy/incident or fleet-task logs — they bypass that pipeline entirely.
- Do NOT assume `agent.auth.token` authenticates ARIA calls — it's `X-Service-Secret` only.
- Do NOT expect data on the first poll or on Linux — anchor-first + Windows-centric.
- Do NOT enable `aria.ssl.skip.verify` casually — it disables TLS verification JVM-wide.
- Do NOT assume delivery is guaranteed — best-effort, no retry, bookmark advances past failed sends.
- Do NOT invent extra `aria.*` keys — only the eleven above exist in code.
