SOC pipeline
How an event becomes a case with evidence behind it.
Everything a collector sends runs the same path. The stages are separate on purpose: each one is recoverable, and each one keeps what it received rather than replacing it.
#The stages
- Receive — the event lands against a registered source, inside that source’s workspace.
- Normalize — a native adapter maps the vendor payload to the shared model, preserving the original.
- Correlate — related signals are grouped rather than counted separately.
- Durable job — work is queued so a restart resumes instead of losing the batch.
- Case and evidence — the correlation becomes a case that carries what produced it.
#Why it is durable
Bounded batches, backpressure, deduplication, leases, retries, dead-letter handling, and replay keep the pipeline recoverable rather than process-local. A burst does not cost you ordering, ownership, or evidence — it costs you latency.
Correlating four alerts into one case does not discard three of them. The case cites all four, and each one keeps its source and arrival time.
#Reading the result
| Endpoint | Returns |
|---|---|
| GET /api/soc/cases | The workspace case queue. |
| GET /api/soc/cases/{id} | One case with the signals it cites. |
| GET /api/soc/cases/{id}/investigations | What was examined, and what was concluded. |
| GET /api/alerts/correlations | How raw alerts were grouped. |
| GET /api/soc/investigations/metrics | Investigation throughput. |
#Response stays behind a boundary
Investigation produces a proposal, not an action. A response intent carries the plan, the evidence, and the reasoning, and waits for a named person.
| Endpoint | Returns |
|---|---|
| GET /api/soc/response/intents | Proposed responses and their state. |
| GET /api/soc/response/policies | What the deployment permits. |
| GET /api/soc/response/catalog | Actions available to propose. |
| GET /api/soc/response/control | The approval boundary’s current configuration. |
Propose, approve, activate — with the actor recorded at the approval step. An unapproved intent is never shown as a completed action.