zuumb: how information flows end to end Diagram

Main path

Wazuh JSON becomes Alert rows, is masked, scored, then grouped into Incident rows
Stages hand off through the database; correlation also reads Alert rows for entities and timestamps

What stays local

Only a masked brief reaches Claude; the raw alert JSON never leaves
Second opinion, similarity, and the detectors run with no API call

Advisory vs authoritative

Similarity hints and analyst-confirmed manual links are display-only: correlation, severity, and chains never read them
The second opinion is advisory unless AI detection is switched off
Approving an action task always writes an audit row; the Active Response call happens only outside dry-run, which is the default. Plain tasks just close