INGEST
Wazuh + event sources
Collect host and network telemetry without asking the reasoning layer to guess what happened.
→
ENRICH
Threat intelligence
Attach reputation and vulnerability context from configured feeds and lookup providers.
→
CORRELATE
Clusters and rules
Group related events by meaningful entities and apply deterministic detection policy.
→
REASON
Scout + Granite
Use local model context to explain significance, uncertainty, and missed-signal risk.
Why the separation matters
Raw events, source identity, timestamps, and rule evidence are preserved before a bounded context is sent to the AI layer. The explanation can be reviewed against those facts.
Operational design
- Async workers coordinate ingestion, enrichment, correlation, and health reporting.
- Configuration is explicit and inspectable rather than embedded in model prompts.
- APIs expose health, rules, TLS status, vulnerability correlation, and alert views.
- De-duplication operates on alert clusters, because clusters are the meaningful review unit.
Portfolio takeaway: observability, provenance, and failure behavior are part of the feature.
Representative pipeline
event → normalize → reputation lookup → correlate by host/IP/time
→ policy assessment → bounded context → analyst-facing explanation