Skip to main content

Implementation Details

This page describes how the platform is implemented at a technical level.

Endpoint agent​

The endpoint agent runs on Windows and uses Sysmon as the primary telemetry source. It reads selected event categories, normalizes event fields, applies local detection rules, enriches matching events, and uploads alerts to the backend.

The agent is intentionally focused on collection, local rule evaluation, enrichment, buffering, and upload. Heavy analysis, retrieval, administration, and AI model access remain in the backend.

Telemetry model​

The event schema is designed to preserve investigation value:

  • Event identity and timestamp
  • Hostname and agent ID
  • Rule ID, rule name, category, severity, and description
  • Process ID, process name, command line, and executable path
  • Parent process information
  • User account and session context
  • File size, hash, and signature status
  • Network destination and source fields
  • OS, architecture, timezone, and locale metadata

Rule engine​

Rules are JSON documents grouped by category. Each category contains a description and a Rules array. A rule includes:

  • Id
  • Name
  • Description
  • Severity
  • Enabled
  • Logic
  • Conditions
  • CreatedAt
  • ModifiedAt

Conditions define field, operator, value, and case-sensitivity behavior. This keeps detection logic portable, reviewable, and updateable without rebuilding the endpoint agent.

Backend services​

The backend uses AWS serverless services:

  • API Gateway for secure HTTP entry points
  • Lambda for ingest, query, administration, rule, AI, and correlation workflows
  • DynamoDB for hot alert, agent, and user-facing investigation data
  • S3 for larger artifacts and retrieval content where needed
  • Cognito for dashboard authentication

The backend is the trust boundary for protected services. Endpoints and browsers interact with backend APIs rather than calling AWS storage, Bedrock, or Pinecone directly.

Retrieval layer​

Pinecone supports semantic retrieval for:

  • MITRE ATT&CK grounding
  • Similar historical events
  • Supporting detection or investigation context

This layer helps the AI produce analysis that is more consistent, explainable, and tied to known behaviors.

AI orchestration​

The AI workflow prepares structured alert context, merges retrieval results, calls Amazon Bedrock Claude Sonnet 4, and stores the resulting analysis for dashboard display.

The output can include summary, reasoning, indicators, risk, MITRE mapping, confidence, retrieval signal, IOCs, and recommended actions.

Follow-up chat​

The chatbot operates in the context of a selected event. It can use event metadata, process tree data, command line, file/network evidence, previous AI analysis, and retrieved context to answer follow-up questions.

The intended behavior is scoped and evidence-based: the chatbot should explain the alert, clarify reasoning, extract IOCs, and recommend checks without pretending to be the final source of truth.

Multi-alert correlation​

The correlation workflow accepts multiple selected alerts and builds a combined context using timestamps, host identity, process relationships, command-line behavior, rules, categories, and severity signals.

The AI layer can then generate a summary, likely campaign assessment, reasoning, attack chain, combined risk, and recommended actions.

Dashboard implementation model​

The React dashboard organizes the workflow into:

  • Overview metrics
  • Detection events
  • Event detail modal
  • Process tree tab
  • AI analysis and chat tab
  • Agent inventory
  • Rule category JSON editor
  • User management
  • Connection status
  • Login activity audit

The dashboard is intentionally evidence-first: AI output is shown beside raw context rather than replacing it.