API Gateway

Core API routing and authentication

Detection Engine

Sigma rule-based threat detection

Log Ingestion Pipeline

Real-time log collection and normalization

Search & Analytics

Log search and event correlation

Notification Service

Alert delivery via email, Slack, and KakaoTalk

Threat Intelligence

IOC feeds and threat data enrichment

Collector Management

Agent deployment and health monitoring

Datastore

Persistent storage and indexing