Streaming anomaly detection and incident investigation for federal zero trust architectures.

Six-tier architecture, end-to-end

Vector edge collectors normalize syslog, OTLP, and HEC payloads into ECS, route through Kafka, and land in a Postgres feature store with TimescaleDB hypertables. A three-model ONNX ensemble scores every event on the hot path. Analysts open every anomaly directly into an investigation panel with pgvectorscale similarity over 100M+ rows and a hash-chained audit log on every action. The reference deployment runs in AWS GovCloud or Azure Government; every tier scales to the platform’s 50,000 events-per-second target.

• Tier 1 · Ingestion

  Vector edge collectors normalize syslog, OTLP, and HEC payloads into ECS, then route through Kafka with backpressure.

  • · Vector aggregator + enricher
  • · Kafka / Redpanda topics events.raw, events.enriched
  • · Postgres feature store with TimescaleDB hypertables
• Tier 2 · Detection

  Three-model ONNX ensemble scores every event on the hot path. Per-model contributions are surfaced to analysts.

  • · Statistical baseline (rolling z-score)
  • · Isolation Forest (unsupervised)
  • · XGBoost supervised classifier
  • · Ensemble combiner with calibrated confidence
• Tier 3 · Investigation

  Analysts open every anomaly into an investigation panel with vector similarity over 100M+ rows and a hash-chained audit log on every action.

  • · pgvectorscale similarity search
  • · Hash-chained audit log (AU-9)
  • · Annotation, escalation, and runbook surfaces
• Tier 4 · Alerting

  Five notification providers with secret redaction at the boundary and end-to-end audit envelopes.

  • · Slack
  • · PagerDuty
  • · Microsoft Teams
  • · Email
  • · Webhook
• Tier 5 · Compliance

  OSCAL 1.1.3 SSP, component definition, and POA&M emitted continuously. 61 FedRAMP Moderate KSIs Cosign-signed.

  • · OSCAL emission with NIST schema validation
  • · KSI catalog + signed JSONL emissions
  • · AU-9 hash-chained audit with S3 Object Lock retention
• Tier 6 · Supply chain

  SLSA Level 3 build provenance, Cosign image signatures, CycloneDX SBOM for every release.

  • · Reproducible builds with pinned digests
  • · Cosign keyless attestation
  • · CycloneDX 1.5 SBOM ingested by GUAC

FedRAMP Moderate baseline, CMMC Level 2 aligned

The platform produces an OSCAL 1.1.3 SSP, component definition, and POA&M that validate against the NIST schema. 61 FedRAMP Moderate Key Security Indicators emit continuously and are Cosign-signed with 10-year retention. Audit logs are hash-chained, AU-9 generated occurred-at-canonical, and shipped to S3 with Object Lock in COMPLIANCE mode for production deployments.

The public sandbox runs the demo profile — sample data only, magic-link auth, no FedRAMP claim. The production posture overlay (infra/helm/sentrygrid/values.govcloud.yaml) is the reference for customer engagements.

Built for the FY26 cybersecurity priorities

Aligned to OMB / ONCD FY2026 cybersecurity investment priorities and CISA’s Continuous Diagnostics and Mitigation program data quality plan. Independently developed under FedRAMP Moderate baseline controls; FY26 readiness lives in the trust center.