Architecture
How AlphaSOC is built, how data moves through it, and how it's deployed.
AlphaSOC is a security data platform with two parts, the Analytics Engine and the Security Data Lake, and interfaces your tools and AI agents use to reach them. Use this page to see how data flows from your sources to your tools. For what AlphaSOC is and the challenges it solves, start with the Introduction.
Design Principles
The AlphaSOC platform has been built following these principles:
- Telemetry across every layer: AlphaSOC analyzes cloud, application, network, and endpoint telemetry in one platform.
- Normalize once, on arrival: AlphaSOC manages the mapping of every event to the Open Cybersecurity Schema Framework (OCSF) when it arrives, and your data remains in OCSF format throughout the pipeline. Detection, the data lake, your SIEM, and AI agents all use the same schema.
- Deep inspection with in-built threat intelligence: As a security company, AlphaSOC builds threat intelligence into the pipeline, so Enrich & Detect inspects and enriches each event as it arrives, before detection runs. It's all included: there are no third-party API keys or integrations to buy.
- Everything in one lake: The Analytics Engine writes all its OCSF output to AlphaSOC's purpose-built Security Data Lake.
- Built for agentic work: Our Security Data Lake is optimized for AI agents as well as analysts. Both query the same normalized, enriched data through indexes instead of scanning raw records.
- Open interfaces: Your tools and AI agents work with the platform through its interfaces, the MCP server and the REST API, not with the engine directly.
- Open standards: AlphaSOC is built on OCSF, Sigma, KQL, and MITRE ATT&CK.
- Nothing for you to manage: There are no agents or sensors to deploy and no parsers to write, and AlphaSOC maintains the data model and runs the engine and the data lake for you in AlphaSOC Cloud.
System Overview
AlphaSOC's platform has two separate parts, the Analytics Engine and the Security Data Lake, and interfaces to both: the MCP server and the REST API. Your tools and AI agents work with the platform through these interfaces. Used together, the engine and the lake form a three-stage pipeline.
Both parts run in AlphaSOC Cloud, which AlphaSOC manages for you. The engine writes everything it produces to the lake, and your tools and AI agents read it from there.
| Analytics Engine | Security Data Lake | |
|---|---|---|
| What it does | Normalizes and enriches telemetry, and detects threats | Indexes and stores every processed event for analysts and AI agents |
| Pipeline stages | Collect & Normalize, Enrich & Detect | Index & Store |
How the Pipeline Works
Data moves through three stages:
- Collect & Normalize: your sources send telemetry over a supported transport, and AlphaSOC maps every event to OCSF on arrival.
- Enrich & Detect: AlphaSOC enriches each event with threat intelligence, then runs managed detections and your Sigma rules. The output is OCSF detection findings and evidence.
- Index & Store: the engine writes everything it produces (findings, evidence, activity, and events) to the Security Data Lake.
Your tools and AI agents then read the data through the platform's interfaces (Investigate), covered under Integrations.
Collect & Normalize
AlphaSOC loads raw telemetry from any source, in any format, with no agents or sensors to deploy. OCSF normalization happens on arrival: collectors auto-discover the data format and map every event to OCSF, so there are no parsers to write.
Enrich & Detect
AlphaSOC enriches every event in real time with threat intelligence from 70+ sources, which hold 1M+ live, curated indicators, and analyzes it on six dimensions, which Capabilities covers in detail.
Detection then runs your custom Sigma rules alongside hundreds of managed AlphaSOC detections aligned to MITRE ATT&CK. You can deploy rules using Detection as Code (DaC).
Enrich & Detect produces two outputs:
- OCSF detection findings, which you can also escalate to your SOC tools
- OCSF evidence, which isn't escalated but is available when you investigate, for example to ask AlphaSOC Cloud about a particular indicator
Both are stored in the Security Data Lake, along with OCSF activity and events.
Index & Store
The Security Data Lake indexes every processed event and keeps the normalized OCSF data (findings, evidence, and activity) hot for 18 months by default. Retention is configurable. The lake holds four aligned data layers (findings, evidence, activity, and events) that match how analysts investigate. Queries run against OCSF field indexes and Bloom filters instead of scanning raw records.
The REST API covers how to query the lake.
Integrations
Telemetry comes in from your sources. Your tools and AI agents connect in one of these ways:
| Interface | Use it for |
|---|---|
| MCP server | AI agents investigating findings, activity, and events |
| REST API | Your own tools and scripts: query the lake, retrieve findings |
| Federated search | Querying the lake from Splunk, Cribl, or the Web Console |
| Escalate | Sending OCSF detection findings to your SIEM, SOAR, or ticketing |
Data Sources
AlphaSOC collects logs from sources across four layers. Examples include:
- Cloud: Amazon Web Services, Google Cloud, Microsoft Azure
- Application: Confluence, GitHub, Jira, Microsoft Entra ID, Okta, Slack
- Network: Amazon Web Services, Cloudflare, Google Cloud, Microsoft Azure, Palo Alto Networks, Zscaler
- Endpoint: CrowdStrike, Microsoft Defender, SentinelOne
You send telemetry over a supported transport, such as Amazon S3, Azure Event Hubs, or Kafka; see Collecting Data. Detection coverage varies by source. For the full list of supported sources, see Data Origins.
Federated Search
Investigate lets analysts query the Security Data Lake where they already work: from Splunk, Cribl Search, or the AlphaSOC Web Console. AlphaSOC for Splunk brings the data lake into Splunk searches, and AlphaSOC Data Lake for Cribl Search does the same in Cribl Search.
AI Tools
AI agents query the Security Data Lake through the AlphaSOC MCP server. Claude, Cursor, and other MCP clients can:
- Drive investigations from a finding down to activity and events
- Look up the reputation of domains, IPs, and hashes
- Overlay sources, fields, and detections on MITRE ATT&CK
- Check CTI indicators against the lake without writing queries
See MCP Server.
Escalation
Escalate delivers OCSF detection findings, in the OCSF Detection Finding schema, to your SIEM, SOAR, or ticketing system. Some integrations support Escalate only; check the integration's page before you plan a workflow around it. See Escalating Findings for formats and transports.
Deployment
AlphaSOC Cloud runs the Analytics Engine and the Security Data Lake for you as one managed pipeline. If you need a different setup, such as running the engine on-premise or writing its output to your own storage, contact support@alphasoc.com.
What's Next
- Capabilities: each stage in detail, including the six dimensions of analysis
- Collecting Data: send your telemetry to AlphaSOC
- MCP Server: connect Claude, Cursor, or another AI tool to your data lake
Questions? Contact support@alphasoc.com.