Skip to main content

Cloud Backend

The backend is built as a serverless control plane for endpoint alerts. It accepts telemetry from agents, stores investigation data, powers the dashboard API, retrieves context from Pinecone, and orchestrates AI analysis through Amazon Bedrock.

AWS services in scope​

  • API Gateway for secure HTTPS endpoints
  • Lambda for ingest, query, admin, and AI workflows
  • DynamoDB for hot investigation data
  • S3 for larger objects, exports, and retrieval content
  • Pinecone for MITRE ATT&CK grounding and similar-event retrieval
  • Amazon Bedrock for LLM inference, with Claude 4 Sonnet used by the current project implementation

Backend responsibilities​

  • Authenticate endpoints and dashboard users
  • Accept and validate incoming alert payloads
  • Store normalized data for fast investigation queries
  • Invoke AI analysis when alert context is ready
  • Retrieve ATT&CK context and similar historical alerts before AI analysis
  • Return alert data and summaries to the dashboard
  • Support event-level chat, IOC extraction, and multi-alert correlation requests
  • Manage detection rule distribution and metadata

Service roles​

API Gateway​

  • Public entry point for agents and dashboard clients
  • Rate limiting and request validation
  • Authentication through authorizers or token validation

Lambda​

  • Stateless processing for API routes
  • Good fit for bursty alert volume
  • Clear separation between ingest, query, and AI functions

DynamoDB​

  • Fast lookup for active investigations
  • Flexible enough for event and entity records
  • Can use TTL for short-lived raw data if needed

S3​

  • Stores larger artifacts and export files
  • Hosts retrieval documents for the RAG pipeline
  • Supports lifecycle rules for cost control

Bedrock​

  • Runs the analysis model
  • Keeps model access in the backend only
  • Supports consistent prompt and policy control

Pinecone​

  • Stores semantic representations of attack knowledge and historical alert context
  • Retrieves similar events when keywords or filenames differ but behavior is alike
  • Provides MITRE ATT&CK grounding before the model generates mappings or rationale