Visibility first
Perimeter events, endpoint telemetry, and LAN-side observations provide different views of the same activity.
Public SOC architecture
From raw telemetry to analyst decisions
SynapticSOC connects perimeter, endpoint, and passive network visibility into a single operational workflow designed around evidence quality, structured triage, and human-reviewed decisions.
Architecture objective
Connected visibility instead of isolated dashboards
The architecture is designed to improve the quality of security decisions by combining multiple observations before recommending action. Each component has a defined operational role.
Correlation before action
Graylog, OpenSearch, and n8n combine context before an analyst decision or response recommendation is recorded.
Human-reviewed response
Automation supports triage and evidence handling without replacing analyst judgment.
Public high-level data flow
How SynapticSOC processes security telemetry
This public diagram describes the main architectural relationships while intentionally excluding sensitive implementation details.
System layers
Each component has a defined operational role
The system is structured as connected layers rather than a single monolithic security platform.
Firewall and IDS telemetry
pfSense · Snort · Suricata
Perimeter traffic, firewall decisions, and IDS alerts provide the first layer of network-security visibility.
Host-level visibility
Wazuh agents
Endpoint telemetry provides host events, security detections, inventory context, and supporting evidence.
LAN-side network observation
Switch SPAN / TAP · Zeek
Zeek passively observes mirrored LAN traffic to help determine whether network activity reached an internal endpoint.
Parsing, enrichment, and routing
Graylog
Graylog acts as the central operational hub for normalizing, enriching, routing, searching, and presenting security context.
Search and retention
OpenSearch
OpenSearch supports indexed search, retained telemetry, and historical investigation across the wider SOC workflow.
Enrichment and analyst workflow
n8n · Graylog · OpenSearch
n8n exchanges context with Graylog and OpenSearch to support enrichment, triage, alerting, acknowledgment, and evidence recording.
Human-reviewed action
Analyst review · Evidence record
The analyst remains responsible for interpreting evidence, confirming the event, and deciding whether response is justified.
Operational dashboards
Grafana
Grafana presents selected operational and reporting views from stored and processed data.
Operational flow
From observation to a documented decision
- 01
Telemetry is collected
pfSense, IDS sensors, Wazuh agents, and Zeek provide distinct network and endpoint observations.
- 02
Events are normalized and enriched
Graylog structures and enriches incoming events so evidence from different sources can be compared consistently.
- 03
Context is searched and retained
OpenSearch supports indexed search and retained context for investigation, workflow queries, and reporting.
- 04
SOAR-assisted triage is performed
n8n coordinates high-level enrichment, correlation, alerting, acknowledgment, and evidence-recording steps.
- 05
The analyst reviews the evidence
Automation supports the decision, but the analyst determines whether observed activity requires a response.
Design principles
Built for credible and explainable operations
The project prioritizes openly available tools and transparent technical decisions.
Automated actions are not enabled simply because a detection fired. Evidence quality and validation come first.
The workflow assists the analyst rather than hiding decisions inside opaque automation.
The architecture reflects real storage, hardware, maintenance, and financial constraints.
Implementation status
Implemented capabilities and planned improvements
SynapticSOC documents what is working today separately from what is still being designed, hardened, or validated.
Implemented and demonstrated
- pfSense firewall telemetry
- Snort and Suricata IDS telemetry
- Wazuh endpoint telemetry
- Zeek LAN-side passive visibility
- Graylog parsing, enrichment, streams, and routing
- OpenSearch search and storage
- n8n SOAR-assisted triage and acknowledgment
- Analyst review and evidence-recording workflow
- Grafana operational dashboards
Planned or being hardened
- Formal retention-policy implementation
- Role-based access control review
- Wazuh active-response hardening and validation
- Expanded response procedures
- Additional compliance-oriented documentation
- Dedicated case-management integration
Public disclosure boundary
Designed to explain the system without exposing it
The public architecture intentionally excludes credentials, tokens, internal addresses, ports, hostnames, firewall rules, Graylog queries, n8n workflow logic, and other implementation details that could increase operational risk.