Tag convention
Tags bundle separate hosts and SCA repos into one application chain. With four standard prefixes, the weakest link of a chain is visible in one custom view. Scenario: Isla Mercantile Group, four apps. Used in blocks I-TAG, I-M10 and I-M11.
The four prefixes
| Prefix | Meaning | Values in the Isla scenario |
|---|---|---|
app: | Application / chain; groups hosts, services and SCA repos | webshop, intranet, payments, loyalty |
tier: | Role within the app | frontend, api, db, payment, auth, app, cache, gateway, vpn, hsm-proxy |
env: | Environment | prod (every Isla host); staging, dev exist in the convention but not in the scenario |
owner: | Responsible team, for escalation | webteam, platform, finance, marketing |
Lower case, no spaces around the colon. One host, four tags: app:webshop tier:db env:prod owner:platform.
Team rule
Insights is one shared environment. Tags and custom views are shared across all participants: this build stores every view under one user, so a saved view shows up in everyone's list. Prefix view names with your team (<team> — chain).
- Tag only hosts of your own app.
- Split your app's host list inside the team: one person per host. HostTagsEdit saves the full tag list, so two people on one host means the last save wins.
- Never remove a tag you did not set. A wrong tag on your host from another team: tell the trainer.
- Leave baseline noise hosts (not under
isla.testorisla.edu.eoncore.net) untagged.
trainctl reset clears all tags and views for everyone; the trainer runs it only between groups.
Tags per host
| Team | Host | IP | Tags | Level | Finding |
|---|---|---|---|---|---|
| webshop | shop.webshop.isla.test | 10.20.1.10 | app:webshop tier:frontend env:prod owner:webteam | recommended | — |
| webshop | api.webshop.isla.test | 10.20.1.11 | app:webshop tier:api env:prod owner:webteam | secure | — |
| webshop | db.webshop.isla.test | 10.20.1.12 | app:webshop tier:db env:prod owner:platform | insecure | F01 |
| webshop | pay.webshop.isla.test | 10.20.1.13 | app:webshop tier:payment env:prod owner:finance | weak | F02 |
| intranet | sso.intranet.isla.test | 10.20.2.10 | app:intranet tier:auth env:prod owner:platform | secure | — |
| intranet | portal.intranet.isla.test | 10.20.2.11 | app:intranet tier:app env:prod owner:platform | secure | F03 |
| intranet | cache.intranet.isla.test | 10.20.2.12 | app:intranet tier:cache env:prod owner:platform | weak | F13 |
| payments | gw.payments.isla.test | 10.20.3.10 | app:payments tier:gateway env:prod owner:finance | secure | — |
| payments | vpn.payments.isla.test | 10.20.3.11 | app:payments tier:vpn env:prod owner:finance | insecure | F05, F06 |
| payments | hsm.payments.isla.test | 10.20.3.12 | app:payments tier:hsm-proxy env:prod owner:finance | insecure | F07 |
| loyalty | app.loyalty.isla.test | 10.20.4.10 | app:loyalty tier:frontend env:prod owner:marketing | recommended | — |
| loyalty | api.loyalty.isla.test | 10.20.4.11 | app:loyalty tier:api env:prod owner:marketing | secure | — |
| loyalty | old.loyalty.isla.test | 10.20.4.12 | app:loyalty tier:frontend env:prod owner:marketing | insecure | F08 |
vpn and hsm have a row on the Hosts page (curated SQL) but no TLS handshakes. Their evidence is in the IPsec/OpenVPN/SSH data; the payments team uses the view variant in the lab guide (Chain view, appendix).
Public vhosts under isla.edu.eoncore.net (www, shop, api, pay, intranet, loyalty, loyalty-old) appear as hosts only after they were seen live (I-M2) or scanned. Tag them with the app: and tier: of the internal host they front and env:prod.
Making the chain visible
- Tag the hosts via HostTagsEdit on HostDetails.
- Build a custom view through the Chat: all hosts with
app:<your app>, with tier, owner and security level, worst first. Query: lab guide, Chain view (appendix). Save as View. - Read the chain. The first row is the lowest level on the ladder. The weakest link is the finding that determines the app's risk, which is not always the lowest rung.
| App | Weakest link | Why |
|---|---|---|
| webshop | F01 db.webshop.isla.test | TLS 1.0 with RSA key exchange, no PFS; pay (3DES, F02) is second |
| intranet | F03 portal.intranet.isla.test | Certificate expires T+14d; cache (F13) is lower on the ladder but less urgent |
| payments | F05 vpn.payments.isla.test | IKEv1 Aggressive Mode, DH group 2, 3DES, SHA1 |
| loyalty | F08 old.loyalty.isla.test | TLS 1.0 + RC4, and not in the client's register (shadow) |
SCA linkage
SCA repos get the same app: tag as the hosts they run on. The chain then runs from source code to running service to crypto or CVE finding (block I-M10).
| Fixture | Tags | Related hosts |
|---|---|---|
webshop-frontend | app:webshop tier:frontend | shop.webshop.isla.test |
webshop-api | app:webshop tier:api | api.webshop.isla.test |
intranet-app | app:intranet tier:app | portal.intranet.isla.test |
payments-svc | app:payments tier:gateway | gw.payments.isla.test |
A team that links intranet-app to app:intranet sees the Log4Shell CVE from the Maven repo next to the certificate finding on portal.