What This Design Does:
A cloud-to-cluster threat hunting reference architecture. AWS VPC/private-subnet substrate bridges into a Kubernetes SOC stack, with edges that narrate the full hunt lifecycle: collect → enrich → ship → store → hunt→ respond.
Design Snapshot
Caveats and Consideration:
Demo-oriented: images are lightweight stand-ins (busybox echo for EDR agents/sim), Wazuh/LDAP unauthenticated, ES security disabled. For production: wire real agents, enable xpack security, and front everything with TLS via the included ingress.
Compatibility:
Design Details
CATEGORY
deploymentCREATED BY
CREATED AT
August 24, 2026VERSION
0.0.7-
MODELS
Related Designs
deployment
vault-0.30.1.tgz
