Skip to content

Security operations

Generated from the architecture model

This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.
Vertical Security
Prototype reference Security prototype (ConnectSoft.DesignPrototypes)
Managed edition ManagedPlus (D33, D34)
Data residency tenant-region (D31)
Catalog Examples catalog · Vision-to-Production path for this vertical

Business problem

Findings from scanners, identity and cloud posture are not correlated; response is manual.

Product intent

Finding ingestion, correlation, cases, playbooks with governed agents and evidence.

What the Factory makes different here: playbooks are agent runs with sandbox and external classes; every action leaves a receipt.

Vision-to-Production path for this vertical

Step Factory platform Agents Blueprints
Vision and product plan Agent Mesh, Control plane Security Architect Agent, Agent Architect Agent vision
Architecture and domain Template & Library (BC-02) Enterprise Architect Agent service, module, security, integration
Experience Template & Library, Factory Studio UX track UX Designer Agent, Frontend Developer Agent —
Recipe and generation Template & Library (BC-15), Agent Mesh, Tools & MCP Security Architect Agent, Agent Architect Agent, Backend Developer Agent, QA Agent module plan from the context map
Quality Observability (BC-22), DevOps / GitOps QA Agent observability, test
Delivery and provisioning DevOps / GitOps (BC-23, BC-24), Runtime Cloud (BC-25) DevOps Agent, Infrastructure Architect Agent —
Operations Product Fleet Operations (BC-35..37) — handover, objectives, rollouts, incidents, off-boarding

Delivery workflows exercised: security-and-compliance-workflows, monitoring-and-observability-workflows.

Generated product shape

C4Context
    title Security operations system context
    Person(user, "Users", "Security users and operators")
    System_Ext(factory, "ConnectSoft AI Factory", "generates, delivers, provisions and operates the product")
    System_Boundary(product, "Security operations") {
        System(ctx_Findings, "Findings", "ingestion, normalization, dedup")
        System(ctx_Cases, "Cases", "cases, severity, timeline")
        System(ctx_Playbooks, "Playbooks", "playbooks, agent runs")
    }
    Rel(user, ctx_Findings, "uses through the product gateway GW-07")
    Rel(factory, ctx_Findings, "descriptor, health, rollouts, incidents, off-boarding")
Hold "Alt" / "Option" to enable pan & zoom

Bounded contexts

Context Responsibility Published events
Findings ingestion, normalization, dedup FindingIngested
Cases cases, severity, timeline CaseEscalated
Playbooks playbooks, agent runs PlaybookCompleted

Modules and templates

Module Template Notes
Microservice ×3 connectsoft-microservice
Agent service connectsoft-ai-agent
Analyst shell connectsoft-blazor-shell
Every product also gets the SaaS foundations (tenants, editions, entitlements, billing, metering) and the product host shape (descriptor, health, operations handover) unless it is a library-only product.

Prototype reference

Security prototype in ConnectSoft.DesignPrototypes shows the intended screens; the UX track (U1–U4) maps prototype destinations to the UX model's screens with keep, merge, rename, retire or new decisions.

Operations as a managed product

ManagedPlus; on-call; playbook actions audited.