zuumb: end-to-end system architecture

zuumb: end-to-end system architecture An architecture diagram generated by Archify. Claude API · default: Haiku 4.5 · Architecture component · only LLM Claude API default: Haiku 4.5 only LLM Manual links · human-confirmed · Architecture component · drives nothing Manual links human-confirmed drives nothing Anomaly detectors · D1 ECOD · D2 beacon · Architecture component · D1 container Anomaly detectors D1 ECOD · D2 beacon D1 container Secret redaction · masks keys, tokens · Architecture component · regex, local Secret redaction masks keys, tokens regex, local Incident similarity · MiniLM · advisory · Architecture component · local model Incident similarity MiniLM · advisory local model Analyst · browser · Architecture component Analyst browser Wazuh Indexer · wazuh-alerts-* · Architecture component Wazuh Indexer wazuh-alerts-* Ingestion · poll · normalise · dedupe · Architecture component · opt-in poller Ingestion poll · normalise · dedupe opt-in poller Triage agent · verdict + reasoning · Architecture component · LLM + few-shot Triage agent verdict + reasoning LLM + few-shot Correlation engine · entity + time window · Architecture component · deterministic Correlation engine entity + time window deterministic Chain stitcher · MITRE tactic order · Architecture component · confidence Chain stitcher MITRE tactic order confidence Dashboard · FastAPI + Jinja2 · Architecture component Dashboard FastAPI + Jinja2 Database · SQLite · Postgres · Architecture component · shared Database SQLite · Postgres shared Second opinion · TF-IDF + LogReg · Architecture component · local ML Second opinion TF-IDF + LogReg local ML Response playbooks · propose tasks · Architecture component Response playbooks propose tasks Approval gate · human click first · Architecture component · dry-run default Approval gate human click first dry-run default Retrain loop · weekly · gated · Architecture component · own container Retrain loop weekly · gated own container Wazuh Manager · Active Response API · Architecture component Wazuh Manager Active Response API _search alerts verdicts incidents chains review, override alert brief masked brief brief promotes model feedback rows alerts auth log lines stores incidents confirm in banner incidents, on open tasks approve click dispatch, live only Legend Frontend Backend Database Cloud Security External