Platform Architecture

이 콘텐츠는 아직 해당 언어로 제공되지 않습니다.

Platform Architecture

KYRA AI MDR uses a multi-layered architecture designed for enterprise-grade security operations. Each layer is purpose-built for its function, ensuring high throughput, secure multi-tenant isolation, and intelligent threat analysis.

Architecture Overview

┌──────────────────────────────────────────────────────────────────────┐
│                         CUSTOMER NETWORKS                            │
│  [Collector Agent] ──secure outbound──► [Ingestion Gateway]          │
└──────────────────────────────────────────────────────────────────────┘
                                    │
┌──────────────────────────────────▼───────────────────────────────────┐
│  LAYER 1: INGESTION & ROUTING                                        │
│  Secure API Gateway → Tenant Router → Event Stream Processing        │
└──────────────────────────────────┬───────────────────────────────────┘
                                    │
┌──────────────────────────────────▼───────────────────────────────────┐
│  LAYER 2: CORE SIEM ENGINE                                           │
│  Detection rules, correlation engine, real-time search, timeline     │
└──────────────────────────────────┬───────────────────────────────────┘
                                    │
┌──────────────────────────────────▼───────────────────────────────────┐
│  LAYER 3: AI AGENT PROCESSING                                        │
│  LLM Router → 12 Specialized Security Agents                        │
│  Triage → Investigation → Attribution                                │
└──────────────────────────────────┬───────────────────────────────────┘
                                    │
┌──────────────────────────────────▼───────────────────────────────────┐
│  LAYER 4: DATA LAYER                                                 │
│  Tenant-isolated storage + analytics + encrypted raw event archive   │
└──────────────────────────────────┬───────────────────────────────────┘
                                    │
┌──────────────────────────────────▼───────────────────────────────────┐
│  LAYER 5: MANAGEMENT CONSOLE                                         │
│  Tenant-isolated dashboard + real-time alerts + PDF/CSV reports      │
└──────────────────────────────────────────────────────────────────────┘

Layer 1: Ingestion & Routing

The ingestion layer receives security events from collector agents deployed in customer networks and cloud environments.

Capabilities:

Secure, encrypted event transport from on-premises and cloud collectors
Automatic tenant identification and routing
Per-tenant rate limiting and quota enforcement
Schema validation and event normalization
Support for log, EDR, and network traffic data sources

Throughput: Up to 15,000 sustained events per second per tenant (Hunt tier).

Layer 2: Core SIEM Engine

The built-in SIEM engine provides detection, correlation, and search capabilities without requiring external SIEM integration.

Capabilities:

Detection rule library with hundreds of pre-built rules
Real-time event correlation across multiple data sources
Full-text timeline search with configurable date ranges
MITRE ATT&CK technique mapping for all detections
Custom detection rule builder (Respond and Hunt tiers)

Tenant Isolation: All queries and detections are scoped to the authenticated tenant. No cross-tenant data access is possible.

Layer 3: AI Agent Processing

Twelve specialized AI agents provide automated threat analysis, investigation, and response capabilities.

Agent	Function
Threat Hunter	IOC pattern recognition, MITRE ATT&CK mapping
OSINT Investigator	External intelligence, domain/IP enrichment
Incident Responder	Playbook execution, evidence collection
Vulnerability Researcher	Exposure scanning, patch prioritization
Forensic Analyst	Timeline reconstruction, root cause analysis
Compliance Auditor	Regulatory mapping, evidence trails
Malware Analyst	Static/dynamic analysis, sandbox coordination
Dark Web Monitor	Underground forum tracking, breach alerts
Strategic Intel	Campaign tracking, APT attribution
Network Detective	Lateral movement detection, C2 pattern identification
Identity Investigator	User/entity behavior analytics, privilege escalation detection
Threat Research Lead	Multi-agent investigation orchestration

Cost-Optimized AI Routing: The platform automatically routes analysis tasks to the appropriate AI model tier based on complexity — lightweight models handle high-volume triage while advanced models are reserved for complex investigations and attribution.

Layer 4: Data Layer

The data layer provides secure, tenant-isolated storage with tiered retention policies.

Storage Type	Purpose	Retention
Hot Storage	Active alerts, recent events, real-time search	7-30 days
Warm Storage	Historical analysis, compliance reporting	Up to 2 years
Cold Archive	Long-term compliance retention	Up to 7 years

All data is encrypted at rest with customer-managed encryption keys. Data residency options support regional compliance requirements.

Layer 5: Management Console

The web-based management console provides a unified interface for security operations.

Features:

Real-time alert dashboard with severity-based prioritization
Incident lifecycle management with task tracking and collaboration
Asset inventory with risk scoring and vulnerability tracking
Compliance posture dashboard with automated evidence collection
Executive and compliance report generation (PDF/CSV)
Real-time notifications via WebSocket push alerts

Multi-Tenant Isolation

Every aspect of the platform enforces strict tenant isolation:

Data Isolation: Separate data partitions per tenant with row-level enforcement
Authentication: JWT-based authentication with tenant-scoped claims
Authorization: Role-based access control (Admin, Analyst, Viewer)
Network: Encrypted communications with mutual authentication
Storage: Per-tenant encryption with customer-managed keys
Search: All queries automatically scoped to the authenticated tenant

Threat Intelligence Integration

The platform integrates with leading threat intelligence feeds:

Feed	Capability
VirusTotal	Malware hash and URL analysis
Shodan	Internet-exposed asset discovery
MISP	Community IOC sharing
Recorded Future	APT intelligence and campaign tracking
NVD / ExploitDB	CVE data and exploit information
Abuse.ch	Botnet and ransomware C2 tracking

Event Processing Flow

Collection — Collector agents gather security events from customer networks and cloud environments
Ingestion — Events are validated, normalized, and routed to the appropriate tenant pipeline
Detection — SIEM engine applies detection rules and correlation logic
AI Analysis — Specialized agents analyze alerts for context, enrichment, and prioritization
Response — Automated playbooks execute containment and response actions
Reporting — Results are surfaced in the management console and reports

Data Retention Tiers

Tier	Alert Retention	Raw Log Retention	Analytics
Detect	90 days	30 days	1 year
Respond	1 year	6 months	3 years
Hunt	5 years	2 years	7 years