Architecture
Three intelligence pillars
Data Nexus, Threat Intelligence, and Observability—inputs, not apps.
Platform pillars are inputs/capabilities. Applications are intelligence outcomes on the spine. Do not confuse the two altitudes.
| Platform (pillar) | Application (outcome) |
|---|---|
| Threat Intelligence | Cybersecurity Intelligence |
| Observability | Observability Intelligence |
| Data Nexus | Domain applications consuming acquired data (News, Market, Automotive, …) |
| Pillar | Role |
|---|---|
| Data Nexus | Acquire and connect diverse data—connectors, streams, normalization, provenance, quality, governed access. |
| Threat Intelligence | Understand what is known about threats—actors, campaigns, TTPs, indicators, vulnerabilities, exploits, advisories, emerging risks. |
| Observability | Understand what is happening in the environment—logs, metrics, traces, events, runtime signals, telemetry, operational context. |
Do not add Cybersecurity as a fourth pillar. Cybersecurity Intelligence is the application outcome for the Threat Intelligence pillar (with Observability + Context).
47 articles on this site. Engineering notes on GitHub.