Skip to content

Security SOC

Purpose

Optional Security SOC module for aggregating security alerts from Edge ingest, investigation workflows, and live dashboard updates.

Boundaries

In scope	Out of scope
Alert ingestion (`security_alert` kind)	Full SIEM replacement
WebSocket push to SPA	Host process telemetry (phase 2)

Key components

Layer	Path
Backend	`Backend/internal/domain/security/`
Frontend	Security routes under `Frontend/src/`
Real-time	WebSocket `/api/ws/security`
Ingest	`security_alert` payload kind

Flow: alert to analyst

sequenceDiagram
    participant Edge as EdgeZu
    participant Ingest as Ingestor
    participant API as Cloud Backend
    participant WS as WebSocket
    participant SPA as Cloud SPA

    Edge->>Ingest: security_alert batch
    Ingest->>API: Persist + process
    API->>WS: Push to subscribed clients
    WS->>SPA: New alert event

Debug scenarios

Issue	Check
Alerts not in UI	Feature flag; ingest kind validation; RLS tenant
WebSocket silent	JWT on `?token=`; proxy timeouts
Stale alert state	Background processing errors in API logs