NATAegisFlow First 60 Minutes Playbook

Use this playbook when you are evaluating NATAegisFlow for the first time and want a guided path from no local setup to a first report review in about one hour.

🛡️

NATAegisFlow is beta software. Run this playbook in advisory mode and keep your existing security gates in place until a human reviewer approves the result.

Recommended sample project

Use the built-in NAT demo e-commerce API as the sample project for your first evaluation. It is local, deterministic, and intentionally vulnerable, so every evaluator can compare the same first report without scanning an external system.

Input	Recommended value
Sample project	Built-in NAT demo e-commerce API
Runtime	Local Python virtual environment
Report format	HTML first, JSON optional
Run mode	Advisory-only beta evaluation
Expected duration	45-60 minutes

Before you begin

Python 3.10 or newer is available locally.
You can create a temporary virtual environment.
You have access to your NAT tenant if you plan to attach the sample report to a dashboard beta run.
You will not paste API keys, bearer tokens, or passwords into issues, screenshots, or shared notes.

0-10 minutes: prepare the evaluator workspace

Create an isolated environment

mkdir -p ~/nat-aegisflow-eval
cd ~/nat-aegisflow-eval
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
pip install nat-engine

Expected output:

Successfully installed nat-engine ...

Confirm the CLI is ready

nat --version
nat doctor --verbose

Expected output:

NAT CLI version ...
Environment checks: passed

10-25 minutes: run the sample project scan

Run the built-in sample project and save a report instead of opening the browser automatically:

nat demo --no-browser --output ./aegisflow-first-report.html

Expected terminal output:

[NAT] Starting demo mode...
[NAT] Built-in example API started on http://127.0.0.1:49823
[NAT] Discovering endpoints...
[NAT] Discovered 20 endpoints across 4 resource groups
[NAT] Starting security analysis...
[CRITICAL] POST /api/v1/auth/login — Credential brute-force (no rate limiting)
[HIGH]     GET  /api/v1/users/{id} — Broken Object Level Authorization
[HIGH]     POST /api/v1/products — Mass Assignment vulnerability
[MED]      GET  /api/v1/orders — Excessive Data Exposure
[LOW]      GET  /api/v1/status — Verbose server information disclosure
[NAT] Scan complete. 12 findings in 00:02:31
[NAT] Report saved to ./aegisflow-first-report.html

The port, timing, and exact report path can vary. The important success signal is a completed scan and an HTML report saved locally.

25-40 minutes: review the first report

Open the report:

open ./aegisflow-first-report.html

If open is not available, open the file from your browser with File → Open.

Expected screenshots

Capture these screenshots for evaluator notes or beta feedback. Redact any tenant names or account identifiers before sharing.

Screenshot	What it should show
Executive summary	Total findings grouped by severity, with critical and high findings visible
Endpoint map	Discovered demo API endpoints grouped by resource area
Finding detail	Evidence for `GET /api/v1/users/{id}` showing a Broken Object Level Authorization finding
Remediation guidance	Fix guidance and severity rationale for one high-impact finding

Example visual checkpoint:

NAT Security Report
Findings: 12 total
Critical: 1  High: 2  Medium: 1  Low: 1
Top finding: POST /api/v1/auth/login — Credential brute-force
Report status: Completed

40-50 minutes: attach the result to a beta evaluation

Use the completed report as the evidence bundle for your first advisory NATAegisFlow evaluation:

In the NAT dashboard, create or open your beta evaluation workspace.
Select Advisory-only mode.
Add the sample project name: Built-in NAT demo e-commerce API.
Attach aegisflow-first-report.html or record the local report path for your evaluator notes.
Link back to the relevant scan ID or dashboard run if your tenant created one.

Expected beta status:

Flow mode: advisory
Evidence: report attached
Reviewer action: review required
Gate impact: no production release gate changed

50-60 minutes: what to evaluate

Use this checklist before deciding whether to continue with a real API pilot:

Setup clarity — Could a new evaluator install NAT, run nat doctor, and start the sample without help?
Flow continuity — Did the beta evaluation preserve the sample project name, report location, scan ID, and reviewer notes?
Finding quality — Are severity, evidence, and remediation details clear enough for a human reviewer?
Coverage signal — Does the report explain which endpoints were discovered and which checks ran?
Approval behavior — Is advisory mode clearly separated from enforcement or deploy blocking?
Failure handling — If setup, auth, quota, or scan execution failed, was the next action obvious?
Shareability — Can you export or screenshot the report without exposing secrets?
Next-step readiness — Do you know what must change before scanning a real owned API?

Known limitations

NATAegisFlow is still in beta; interfaces, dashboard labels, response fields, quotas, and supported stacks may change.
The built-in sample project is deterministic and intentionally vulnerable, so it validates onboarding flow more than live target coverage.
Treat private-network targets, self-hosted runners, OAuth2, PR comments, and SARIF export as experimental unless your tenant has explicit beta support.
Do not use NATAegisFlow as the only production release blocker during this evaluation.

For the full beta constraints, see Beta limits, Supported stack matrix, and Operational Setup and Troubleshooting.

Next steps

Repeat the playbook with one owned non-production API and its OpenAPI contract.
Run the operational setup checklist before trying Docker, dbt metadata, or CI integration.
Review the Scan API request and result schema before automating beta runs.
Use onboarding troubleshooting if tenant, API key, quota, or first-scan setup fails.

Was this helpful?

Beta Overview Setup & Troubleshooting