Services | AKS Pods
🛡️

SEIP

Security Event Intelligence Platform

End-to-end pipeline for collecting, enriching, and analysing Windows security events at scale. Sysmon events flow from Windows agents through Kafka into DynamoDB, where an LLM-powered analysis worker scores and classifies them in real time.

Services

🔌

MCP Server

Model Context Protocol server. Exposes SEIP tools and resources to AI assistants, enabling agentic workflows over security event data.

🧠

Deep Mind

LLM-powered analysis worker. Three-stage fingerprint pipeline (hash → semantic → Azure OpenAI) writes severity scores back to PostgreSQL.

🎛️

Worker Orchestrator

Control panel for the Deep Mind worker pool. Shows KEDA scaling state, unprocessed event counts, and allows manual capacity overrides.

🤖

Models Proxy

Unified LLM proxy. Routes chat requests to Azure OpenAI, Anthropic, and other providers. Tracks usage per model.

📥

Kafka Consumer

Reads Windows security events from Confluent Kafka and writes them to PostgreSQL. Entry point for all events into the pipeline.

⚙️

Pattern Manager

Manage security event patterns, generate Lua noise filters via LLM, upload signed filter bundles to Azure Blob for hot-reload.

💰

Cost Dashboard

Azure Cost analysis. Shows cost breakdowns by service category across the SEIP infrastructure.

Background Services

🖥️

seip-agent-win

Windows agent. Collects security events via Sysmon + Fluent Bit and streams them to Confluent Kafka.

🏗️

Azure Infrastructure

Terraform IaC: AKS (NAP + KEDA scale-to-zero), PostgreSQL Flexible Server, ACR, Key Vault, VNet + NAT Gateway.

Data Flow

ingestion

🖥️ Windows Agent Sysmon + Fluent Bit
☁️ Kafka SASL/SSL
📥 Consumer :8181
🗄️ DynamoDB security-events
🧠 Deep Mind ASG workers

analysis output

🗄️ DynamoDB severity + analysis
🔍 Event Browser :3000

agentic access

🗄️ DynamoDB security-events
🔌 MCP Server :8765
🤖 AI Assistant agentic tools

noise suppression loop

⚙️ Pattern Manager :8183
🪣 S3 Lua filter bundle
🖥️ Windows Agent hot-reload