synoti logosynoti logo
Getting Started with rules and filters Architecture Overview

Architecture Overview

Several components work together within the EventProcessor and Unified Security Stack integration to deliver a complete security monitoring solution.

Core Components

EventProcessor

The central engine tasked with processing security events.

extension

EventProcessor Plugins

Modules that expand EventProcessor functionality, including parsing, analysis, and more.

Unified Security Stack Plugins

Dedicated plugins that connect Unified Security Stack features to the EventProcessor.

go-sdk

A Go SDK providing shared interfaces and common functionality for the EventProcessor and its plugins alike.

rule

Rules

YAML files that specify detection logic for security threats.

Filters

YAML files that define how data is extracted and transformed from raw logs.

Plugin Architecture

The EventProcessor uses a micro-plugin architecture where plugins operate as independent processes. Communication takes place via gRPC over Unix domain sockets.

Key Benefits

  • Flexibility: Introduce new functionality without altering the core engine.

  • Isolation: Plugin failures do not always crash the entire processor.

  • Language Independence: Although Go is the primary language, any language with gRPC support can in theory be used.

For more details on specific plugins, see Components.

Support and Resources

Discord Community

Documentation