TIDIRArchitecture & Research Platform

Threat Intelligence, Detection, Investigation & Response — unified reference architecture for modern SecOps.

🛰️

Threat Intelligence (CTI)

Ingestion across STIX/TAXII, dynamic confidence decay scoring, low-latency Redis caching, and automated retro-hunting.

🌊

High-throughput streaming bus, line-rate OCSF schema normalization, and dual-tier Hot Index vs. Iceberg Lakehouse.

🎯

Stateful stream pattern detection paired with lakehouse SQL analytics under a GitOps Detection-as-Code pipeline.

🔍

Entity 360 resolution, parent-child process trees, network/identity graphs, unified timeline reconstruction, and evidence lockers.

⚡

Blast-radius risk-tiered SOAR playbooks separating low-risk automated containment from human-gated disruptive actions.

🔄

Incident discoveries and tuning feedback automatically enrich CTI repositories and calibrate detection rules.