Fingerprint and discover
After 24–48 hours of representative shadow traffic, Control Core aggregates traffic fingerprints used to recommend compliance packs.
What gets fingerprinted
| Signal | Source | Example |
|---|---|---|
| Path tokens | Request URL segments | /payments, /kyc, /patients |
| Request fields | JSON/query keys on ingress | amount, customer_id, mrn |
| Response fields | Egress keys (when Bouncer intercept enabled) | transaction_id, risk_score |
Fingerprints are aggregated server-side — the protected application remains policy-blind.
Trigger discovery scoring
- Open Compliance & Gaps → note recommended packs in the onboarding wizard or dashboard.
- Optionally run SSIE classification:
curl -X POST "$PAP_API/v1/compliance/ssie/run?environment=sandbox" \
-H "Authorization: Bearer $TOKEN"
- Review dashboard summary:
curl -s "$PAP_API/v1/compliance/dashboard/summary?environment=sandbox" \
-H "Authorization: Bearer $TOKEN" | jq
Troubleshooting: If all packs score low, increase traffic diversity (more endpoints, methods, and field names). Mirror production patterns in sandbox when safe. See Troubleshooting.
Expected outcomes
- Pack relevance scores above
min_confidence(default 0.55) for matching verticals - Gap cache entries begin populating after SSIE cycle
- Shadow would-deny count > 0 when deny controls are activated
Next steps: Compliance packs