SOC pipeline
How an event becomes a case with evidence behind it.
Everything a collector sends runs the same path. The stages are separate on purpose: each one is recoverable, and each one keeps what it received rather than replacing it.
The stages
- Receive — the event lands against a registered source, inside that source’s workspace.
- Normalize — a native adapter maps the vendor payload to the shared model, preserving the original.
- Correlate — related signals are grouped rather than counted separately.
- Durable job — work is queued so a restart resumes instead of losing the batch.
- Case and evidence — the correlation becomes a case that carries what produced it.
Why it is durable
Bounded batches, backpressure, deduplication, leases, retries, dead-letter handling, and replay keep the pipeline recoverable rather than process-local. A burst does not cost you ordering, ownership, or evidence — it costs you latency.
Correlating four alerts into one case does not discard three of them. The case cites all four, and each one keeps its source and arrival time.
Reading the result
| Endpoint | Returns |
|---|---|
| GET /api/soc/cases | The workspace case queue. |
| GET /api/soc/cases/{id} | One case with the signals it cites. |
| GET /api/soc/cases/{id}/investigations | What was examined, and what was concluded. |
| GET /api/alerts/correlations | How raw alerts were grouped. |
| GET /api/alerts/correlations/{id} | One group and why its alerts belong together. |
| GET /api/soc/investigations | Investigations across every case, newest first, cursor paged. |
| GET /api/soc/investigations/metrics | Investigation throughput. |
Response stays behind a boundary
Investigation produces a proposal, not an action. A response intent carries the plan, the evidence, and the reasoning, and waits for a named person.
| Endpoint | Returns |
|---|---|
| GET /api/soc/response/intents | Proposed responses and their state. |
| GET /api/soc/response/policies | What the deployment permits. |
| GET /api/soc/response/catalog | Actions available to propose. |
| GET /api/soc/response/control | The approval boundary’s current configuration. |
Propose, approve, activate — with the actor recorded at the approval step. An unapproved intent is never shown as a completed action.