Loading investigation data…
WorkspaceArchitecture
SIMULATED TELEMETRY
A small, inspectable architecture with explicit trust boundaries.
One API, one relational database, and a replaceable model provider
Identity · API Gateway · Endpoint · Atlas application
Validated canonical events. Immutable source records.
Versioned rules identify individual signals and temporal sequences.
Individual signals with rule IDs and source-event references.
Principal, time, and rule diversity form a case. Device and session links provide context.
Scoped evidence, entity relationships, and analyst decisions.
Model output crosses a validation boundary before an analyst sees it
Explicit incident scope selects the allowed evidence set.
Typed observations only. Telemetry text is untrusted data.
Replaceable, read-only provider. No database session or tools.
Reject malformed output, unknown fields, and unsupported claims.
Every reference must belong to the case and the supplied context.
Inspect sources. Save drafts. Approve findings and reports explicitly.
The API selects a bounded evidence set for the requested incident. Only a small projection of that case enters the model context. Raw telemetry and annotations remain untrusted data.
Structured responses are validated for schema, citation membership, and supported claim types. Malformed or unsupported results fail closed. The deterministic local provider uses the same boundary as the configured external provider.
The model receives no database session or mutation tools. Incident edits, evidence annotations, approved findings, and report approval are separate analyst actions recorded in audit history.
Normalized events, alerts, incidents, evidence associations, entities, findings, and audit records live in one transactional database. Indexed queries and server-side pagination support this bounded dataset.
A detection describes a signal. Correlation links related signals using explicit identity and temporal relationships. Neither component depends on a model response or opaque risk score.
Entity edges are derived from event associations. The investigation UI exposes their supporting evidence so analysts can inspect how each relationship was established.
Deterministic synthetic data, four telemetry adapters, rules as code, temporal detections, deterministic correlation, evidence annotations, scoped AI analysis, structured-output validation, executed boundary evaluations, analyst findings, reports, and audit history.
This is a local single-analyst application. Production identity and authorization, tenant isolation, durable tamper-resistant audit storage, retention controls, distributed ingestion, and workload-specific scaling require additional engineering.
Deterministic and adversarial fixtures test application boundaries. Passing those cases does not establish live-model prompt-injection resistance, enterprise readiness, or compliance certification.