Documentation / Architecture
One behavior layer, many consumers.
Our architecture separates representation from detection. Telemetry is structured into behavior before rules, models, investigators or response systems decide what that activity means.
The processing boundary
Endpoint ─┐
Kubernetes ─┤
AI agent ─┼─> Behavior layer ─> Detection
Network * ─┤ ├> Hunting
Identity * ─┤ ├> Investigation
Cloud * ─┤ └> Response
Email * ─┘
Sources marked * are not supported yet. Today the platform supports Linux and Windows endpoints, Kubernetes and AI agents. The representation itself does not depend on the source, which is why further sources can be added without changing what detection and investigation read.
The behavior layer is not a view inside a detector. It is the shared representation every downstream consumer reads.
Responsibilities
| Layer | Responsibility | Explicit non-responsibility |
|---|---|---|
| Telemetry sources | Emit observations from supported sources (Linux and Windows endpoints, Kubernetes, AI agents) | Define a complete behavior |
| Behavior layer | Structure context, actions, effects, relationships and observability | Decide every detection outcome |
| Detection mechanisms | Evaluate behavior using rules, models or correlation | Own the canonical representation |
| Investigation | Navigate behavior, relationships and evidence | Reconstruct every connection from raw logs |
| Response | Act from an inspectable conclusion | Erase the uncertainty beneath a decision |
Evidence identity
Behavior formation must preserve where supporting material came from. Every behavior can carry identifiers for contributing evidence; a detection can in turn carry the behavior identifiers that supported it. This makes the chain navigable without turning it into an audit log of user activity.
Consumer independence
Several detection mechanisms may operate over the same behavior. A rule change should not redefine the underlying activity, and a new consumer should not require telemetry to be normalized into a second, incompatible behavioral object.