diff --git a/common-mortakaz/integration-1.md b/common-mortakaz/integration-1.md
index e69de29..28d1ff3 100644
--- a/common-mortakaz/integration-1.md
+++ b/common-mortakaz/integration-1.md
@@ -0,0 +1,5 @@
+# Mortakaz Product Integration 1: Identity & SSO Integration
+
+- **Selected Product**: Mortakaz Identity / Auth Suite.
+- **Integration with Ghaymah**: Integrate with Ghaymah IAM & Secrets Manager to allow unified single sign-on (SSO) for cloud workloads.
+- **Value Addition**: Seamless, secure authentication for developers without exposing credentials across platforms.
diff --git a/common-mortakaz/integration-2.md b/common-mortakaz/integration-2.md
index e69de29..968b579 100644
--- a/common-mortakaz/integration-2.md
+++ b/common-mortakaz/integration-2.md
@@ -0,0 +1,6 @@
+# Mortakaz Product Integration 2: AI Analytics Engine
+
+- **Selected Product**: Mortakaz AI Analytics.
+- **Integration with Ghaymah**: Deploy on Ghaymah Container Platform linked with mithal.space search indexing.
+- **Value Addition**: Delivers sovereign privacy-first AI search insights for enterprise users.
+- **Feasibility Winner**: Integration 1 (Identity SSO) is the most feasible due to immediate compatibility with Ghaymah IAM.
diff --git a/q4-siem/dashboard.html b/q4-siem/dashboard.html
index 3a151a1..f4ad915 100644
--- a/q4-siem/dashboard.html
+++ b/q4-siem/dashboard.html
@@ -1,5 +1,5 @@
-
+
Ghaymah Mini SIEM Dashboard
@@ -8,23 +8,23 @@
.card { background: #1e293b; padding: 20px; border-radius: 8px; margin-bottom: 20px; }
h1 { color: #38bdf8; }
table { width: 100%; border-collapse: collapse; margin-top: 10px; }
- th, td { padding: 12px; border: 1px solid #334155; text-align: right; }
+ th, td { padding: 12px; border: 1px solid #334155; text-align: left; }
th { background-color: #334155; }
.CRITICAL { color: #ef4444; font-weight: bold; }
.HIGH { color: #f97316; font-weight: bold; }
- 🛡️ منصة غيمة — لوحة تنبيهات SIEM
+ 🛡️ Ghaymah Cloud — Mini SIEM Alert Dashboard
-
التنبيهات الأمنية المكتشفة
+
Detected Security Alerts
- | مستوى الخطورة |
- نوع الهجوم |
- عنوان IP |
- التفاصيل |
+ Severity |
+ Attack Type |
+ IP Address |
+ Details |
diff --git a/q5-ransomware-dr/ransomware-plan.md b/q5-ransomware-dr/ransomware-plan.md
index e69de29..9a8b145 100644
--- a/q5-ransomware-dr/ransomware-plan.md
+++ b/q5-ransomware-dr/ransomware-plan.md
@@ -0,0 +1,15 @@
+# Ransomware Incident Response & Recovery Plan
+
+## 1. First 60-Minute Emergency Action Plan
+- **Min 00-15 (Containment)**: Immediately isolate compromised Ghaymah Block Storage volumes via Network Policies. Revoke all API keys and IAM tokens associated with the affected storage node.
+- **Min 15-30 (Triage & Assessment)**: Identify encryption entry point, identify affected snapshot IDs, and confirm immutable backup status.
+- **Min 30-60 (Eradication)**: Terminate infected container instances and flush compromised cache/session stores.
+
+## 2. Ghaymah Backup & Recovery Strategy
+- **3-2-1 Backup Rule**: Maintain 3 copies of data across 2 different storage media types, with 1 immutable offsite copy on Ghaymah Block Storage WORM policies.
+- **RPO (Recovery Point Objective)**: < 15 minutes via automated snapshotting.
+- **RTO (Recovery Time Objective)**: < 60 minutes for clean environment restoration.
+
+## 3. Comprehensive Prevention Plan
+1. Enforce Zero-Trust architecture and Least Privilege IAM policies across storage access points.
+2. Enable file integrity monitoring (FIM) and automated write-rate anomaly detection on Ghaymah Block Storage.