> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/architecture.md).

# Architecture

A simple, end-to-end picture of how Sec1 SIEM + EDR/XDR works — useful before you roll out agents or plan a deployment.

## The big picture

Lightweight agents run on your endpoints and servers, and existing log sources feed in alongside them. All that data flows to the Sec1 platform, where it is parsed and enriched, a detection engine evaluates it and raises alerts, related alerts correlate into incidents, and AI triage helps your SOC understand and respond. It is one product covering SIEM, EDR and XDR — log collection, endpoint telemetry, detection, correlation and response from a single console.

## Components

```mermaid
flowchart TD
    subgraph Sources["Your environment"]
        A["Sec1 agent<br/>(EDR/XDR telemetry + SIEM log inputs:<br/>file tail, syslog, HTTP/TCP receivers)"]
        L["Existing pipelines<br/>(Logstash, Beats, rsyslog)"]
    end

    subgraph Platform["Sec1 platform"]
        I["Ingest<br/>(token-authenticated)"]
        P["Pipeline<br/>(parse to ECS, enrich, store)"]
        D["Detection engine<br/>(rules → alerts)"]
        C["Correlation<br/>(alerts → incidents)"]
        AI["AI triage & investigation"]
        R["Response<br/>(isolate, quarantine, device control,<br/>application control, live-response scripts)"]
        M["Central management<br/>(agent config, governance, entitlement)"]
        U["Console / UI"]
    end

    L -->|push directly| I
    L -->|or via| A
    A -->|batch + compress<br/>durable on-disk spool| I
    I --> P --> D --> C --> AI --> U
    AI --> R
    R -->|commands| A
    M -->|server-pushed config| A
    M --> U
```

The pieces:

* **Agent** — one unified agent per host. It collects EDR/XDR endpoint telemetry (processes, network, file integrity, software, peripherals) and acts as a SIEM log input via file tail, syslog and HTTP/TCP receivers that existing shippers can push to.
* **Ingest** — token-authenticated entry point. The agent batches and compresses events and keeps a durable on-disk spool, so events survive a network outage or a platform restart. Existing Logstash or Beats setups can also push directly to ingest.
* **Pipeline** — incoming data is parsed to a common schema (ECS), enriched and stored for search and detection.
* **Detection engine** — rules evaluate the data and raise **alerts**.
* **Correlation** — related alerts are grouped into **incidents**.
* **AI triage & investigation** — incidents come with an AI-generated summary, an attack timeline and a MITRE ATT\&CK mapping.
* **Response** — act on a host: isolate it from the network, quarantine a file, apply device control or application control, or run a signed live-response script.
* **Central management** — the platform pushes agent configuration, applies governance (per-host or per-group rule scopes) and gates features by subscription entitlement.

## Data flow

The path a single event takes, end to end:

```
event → ingest → parse / enrich → detect → alert → correlate → incident → triage → respond
```

1. An agent (or an existing shipper) sends an **event**.
2. **Ingest** authenticates and accepts it.
3. The **pipeline** parses it to ECS, enriches it and stores it.
4. The **detection engine** evaluates it and may raise an **alert**.
5. **Correlation** groups related alerts into an **incident**.
6. **AI triage** investigates the incident and maps it to MITRE ATT\&CK.
7. An analyst (or an automated playbook) runs a **response action** on the affected host.

## Deployment model

* **Hosted and live.** The SIEM console is live at [**siem.sec1.ai**](https://siem.sec1.ai) — a static single-page app served over HTTPS. All of its backend calls go through the platform gateway at **api.sec1.io**, which authenticates every request and routes it to the right SIEM service.
* **One gateway in front.** The gateway (APISIX) terminates OpenID Connect, verifies the caller and proxies to the backend services over a private network. The backend services and their datastores are not exposed to the internet — only the gateway and the console are reachable.
* **Single sign-on.** SIEM, EDR and XDR are products in the unified Sec1 platform. They share one identity, so the same credentials that sign you in to the platform sign you in to SIEM. See [Setup & Access](/user-docs/10-siem-edr-xdr/setup-and-access.md).
* **Outbound only.** The agent only makes **outbound** connections to the platform. No inbound ports are opened on the platform for agents to connect to, and the agent opens no listening ports on the host unless you explicitly enable a log receiver for your own shippers.
* **Proxy and CA aware.** The agent honours `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` and accepts a custom root CA, so it works behind a corporate proxy that does TLS interception.
* **Single static binary.** One self-contained binary per OS (Windows, Linux, macOS) with no runtime to pre-install.
* **Cloud or on-prem.** The same model runs against the Sec1-hosted platform or an on-prem deployment.

## What runs where

| Where                     | Runs                                                  | Does                                                                                                                       |
| ------------------------- | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Endpoint / server**     | Sec1 agent (single binary)                            | Collects endpoint telemetry and tails logs; receives syslog and HTTP/TCP from local shippers; executes response commands.  |
| **Network / log sources** | syslog, Logstash, Beats, rsyslog                      | Existing log sources send to a Sec1 agent receiver or push directly to ingest.                                             |
| **Gateway**               | API gateway (api.sec1.io)                             | Terminates OpenID Connect, authenticates every request and routes it to the right SIEM service over a private network.     |
| **Platform**              | Ingest, pipeline, detection, correlation, AI, console | Authenticates and parses data, runs detection and correlation, generates AI triage and serves the console at siem.sec1.ai. |

## How EDR/XDR telemetry and response work

On endpoints the agent collects activity at the source, with kernel-grade fidelity where the OS allows it:

* **Linux** — process and network telemetry via eBPF, so connections and process events are captured in the kernel rather than inferred from polling.
* **Windows** — event tracing (ETW) and the Windows Event Log channels (Security, System, Application, Sysmon), so native OS events feed straight into detection.
* **macOS** — process and software inventory plus device visibility.

That telemetry — processes, network connections, file integrity, installed software and peripherals — streams to the platform, where it powers detections, vulnerability findings and the process tree shown in an incident. When an analyst (or a playbook) acts, the platform sends a command back down to the agent: isolate the host, quarantine or delete a file, kill a process, block a device or run a signed live-response script. The agent carries it out and reports the result. See [Response actions](/user-docs/10-siem-edr-xdr/response-actions.md).

## Notes and honest limits

* **macOS device enforcement is visibility-only.** On macOS the agent inventories connected peripherals but does not block them; enforcement (block) applies on Windows and Linux.
* **Live-response scripts are signed.** Scripts dispatched to a host are cryptographically signed, so an agent only runs commands genuinely issued by the platform.

## Where to go next

* [**Data collection**](/user-docs/10-siem-edr-xdr/data-collection.md) — the two ways to get data in and how one agent serves SIEM, EDR and XDR.
* [**Install the agent**](/user-docs/10-siem-edr-xdr/install-the-agent.md) — get a host reporting in under a minute.
* [**Endpoints & telemetry**](/user-docs/10-siem-edr-xdr/endpoints-and-telemetry.md) — what each host reports.
* [**Detections, alerts & incidents**](/user-docs/10-siem-edr-xdr/detections-alerts-incidents.md) — the detection-to-incident flow.
* [**Response actions**](/user-docs/10-siem-edr-xdr/response-actions.md) — the live-response toolkit.