Components

The ecosystem is built on a two-tier architecture: the high-performance EventProcessor engine (managed core) and the Unified Security Stack Extension layer for the open-source ecosystem.

EventProcessor (Managed Core)

EventProcessor serves as the proprietary, high-performance engine responsible for orchestrating the data pipeline. Although the core engine repository remains private, its capabilities can be fully extended through the public SDK and the custom plugin system.

Parsing Plugins (Built-in)

Granular steps that filters apply to organize data.

Data Extraction: json, kv, csv, grok.
Transformation: rename, cast, reformat, trim, add.
Control: delete, drop.

Analysis Engines

cel: The primary engine for evaluating Rules through Common Expression Language.
feeds: A threat intelligence engine that matches logs against ThreatWinds malicious indicators (IPs, Domains, Hashes).

Extensible Component Ecosystem

Unified Security Stack ships with a modular layer of specialized plugins and integrations that can be extended for your environment.

Category	Plugin(s)	Role
Ingestion	inputs	A consolidated entry point for logs through HTTP and gRPC (Agents, Syslog-ng).
Integrations	aws, azure, gcp, o365, crowdstrike, sophos, bitdefender	Built-in collectors for cloud and EDR.
Parsing	geolocation	Adds geographic context to events.
Output / Storage	events	All events that are successfully processed are indexed into OpenSearch (using the v1-7-22-log-* pattern).
Correlation / Lifecycle	alerts	Carries out alert deduplication, parent-child linking, and indexing into the v1.7.22-alert index.
Notification	stats	System metrics alongside internal health reports.
Management	config	A service for centralized configuration.

Architecture & Extensibility

Orchestration

The engine oversees adaptive queues and worker pools to guarantee high-speed ingestion and processing. It maintains enforcement of the Standard Event Schema across all components.

The Public go-sdk

Every component—both built-in and custom—interfaces with the system via the go-sdk.

Type Safety: Shared definitions for Logs, Events, and Alerts.
Connectivity: gRPC service definitions covering Parsing, Analysis, and Correlation.
Development: Support for hot reloading of custom plugins.