# Threat Radar methodology (Phase 4 / TDD-415)

Public **Threat Radar** and the free CTI API stub publish **scrubbed aggregates
only**. They are not a production AGTI feed and do not claim actor attribution.

## Inputs

- Deterministic ATT&CK technique IDs and coarse behavior families from Ops
  Investigate / AGTI extractors.
- Counts are session-aggregate tallies, never raw session transcripts.

## Scrubbing (SEC-AG-004)

Before leave-tenant publication, every payload passes `agti.ScrubEgress`:

- **Opt-in** required (`opt_in` / `opt_in_public`).
- **Jurisdiction filter** (closed set: EU, US, UK, APAC, GLOBAL_PUBLIC).
- **Fail closed** on blocked field classes and values: internal/private IP,
  internal hostnames, usernames/emails, sensor/session identifiers.

## Re-identification & abuse

Tests assert fail-closed re-identification rejection:

- Raw IPs, `sensor_id` / `session_id`, and username-like client hints are
  rejected on the free CTI API stub.
- Per-key rate limits deny abusive clients (fail closed, `rate_limited`).

## Non-claims

- No production AGTI maturity claim from radar publication alone.
- No automatic containment, IPS push, or regulatory filing from radar cells.
- Methodology evidence: `engine/internal/threatradar/radar_tdd415_test.go`
  (TDD-415) and `engine/internal/agti/scrub_tdd412_test.go` (TDD-412).