Catalogue
What this deployment can ingest, and what the pluggable tiers cost you.
Processor profiles— these are not equivalent (ADR-0002)
| Profile | Enriches CI | Carries topology | Operated by | Note |
|---|---|---|---|---|
| data-prepper | deferred to engine | yes | external Data Prepper deployment | CI enrichment is deferred to ARGUS-engine, so correlated insight lands later and raw search results are not CI-tagged. |
| otel-only | deferred to engine | no | external OTel Collector | Smallest footprint. Cannot carry topology signals, and CI enrichment is deferred to ARGUS-engine. |
| python-normalizer | inline | yes | this platform | Default. Vendor-neutral and full-featured; CI resolution happens inline. |
Sources
| Source | Signal | Collection | Phase | State | Description |
|---|---|---|---|---|---|
| cmdb.servicenow | topology | pull | 1 | built | CI inventory and dependency graph via the ServiceNow Table API (cmdb_ci, cmdb_rel_ci). Authoritative CI source per ADR-0001. |
| cmdb.postgres | topology | pull | 1 | built | CI inventory from the ARGUS aiops.cis / ci_identities / application_cis tables. Development and demo provider. |
| generic.unclassified | log | push | 2 | built | Messages the syslog classifier could not fingerprint. A real source with a real topic, not a bin: unclassified traffic is stored and counted so misconfigured senders are visible rather than silently filed under the wrong source. |
| host.linux | log | push | 2 | built | syslog/journald from Linux hosts via agent or syslog gateway. |
| host.windows | log | push | 2 | built | Windows Event Log channels via agent or Windows Event Forwarding. |
| host.aix | log | push | 2 | built | AIX and other Unix syslog. Common in PH bank core estates. |
| net.syslog | log | push | 2 | built | Router/switch/firewall syslog. All vendors share this source; the vendor is an attribute (observer.vendor) resolved by the classifier, not a separate source. |
| net.snmp_trap | event | push | 2 | planned | SNMP v2c/v3 traps from network and facility equipment. |
| k8s.events | event | push | 2 | built | Kubernetes event stream. |
| db.oracle | log | push | 2 | built | |
| db.mssql | log | push | 2 | built | |
| db.postgres | log | push | 2 | built | |
| mw.websphere | log | push | 2 | built | |
| mw.tomcat | log | push | 2 | built | |
| generic.http | event | pull | 2 | built | Configurable HTTP poller for tool APIs that expose a JSON list endpoint. Covers the common shape while vendor-specific connectors are built. |
| mon.solarwinds | event | pull | 2 | planned | Alerts, config baselines and drift from SolarWinds. Pull connector — same shape as aisoc's API collectors. |
| mon.dnacenter | event | pull | 2 | planned | Network state, topology and compliance from Catalyst Center. |
| mon.thousandeyes | event | pull | 2 | planned | |
| itsm.servicenow | event | pull | 2 | planned | Incident, change and problem records. |
| vuln.qualys | event | pull | 2 | planned | |
| backup.veeam | event | pull | 2 | planned | |
| host.metrics | metric | scrape | 3 | built | CPU/memory/disk/network from node exporters or OTel hostmetrics, via Prometheus remote-write. |
| k8s.metrics | metric | scrape | 3 | built | |
| net.netflow | metric | push | 3 | planned | |
| apm.metrics | metric | scrape | 3 | built | RED metrics: scraped, or derived in-pipeline from logs and events now and from spans once Phase 4 lands. |
| apm.otlp | trace | push | 4 | built | OpenTelemetry spans over OTLP, both protobuf and JSON. Consolidates the existing ARGUS demo trace path into the shared pipeline. |
| k8s.logs | log | push | 4 | built | Pod/container logs from an in-cluster OpenTelemetry Collector's filelog receiver, exported over OTLP/HTTP (protobuf or JSON) to the same receiver that serves apm.otlp. Correlates to a span via trace.id/span.id when the workload is instrumented. |
| aws.cloudwatch_logs | log | push | 7 | planned | Log groups via subscription filter -> Firehose -> HTTP ingest. Subscription is the scalable path; polling GetLogEvents does not keep up at estate scale. |
| aws.cloudwatch_metrics | metric | pull | 7 | planned | GetMetricData polling, or a CloudWatch metric stream via Firehose — cheaper and lower-latency at volume. |
| aws.eks | event | push | 7 | planned | Control-plane logs via CloudWatch. Cluster events and pod metrics come from an in-cluster Collector, not the AWS API. |
| aws.ecs | event | push | 7 | planned | Task state changes via EventBridge; Container Insights for metrics. |
| aws.rds | log | pull | 7 | planned | Slow-query and error logs via DownloadDBLogFilePortion; Enhanced Monitoring for metrics. Fits the connector framework. |
| aws.elb | log | pull | 7 | planned | Access logs land in S3, so this needs an S3-notification collector — a different collection shape to everything built so far. |
| aws.health | event | pull | 7 | planned | AWS Health events. Small volume, high value for correlation. |
| azure.monitor_logs | log | push | 7 | planned | Diagnostic settings -> Event Hub -> ingest. Event Hub is Kafka-wire-compatible, so this may be a Kafka consumer needing no new transport and reusing the processor tier unchanged. |
| azure.monitor_metrics | metric | pull | 7 | planned | Azure Monitor metrics API, or diagnostic settings to Event Hub. |
| azure.aks | event | push | 7 | planned | Control-plane diagnostics; cluster events via in-cluster Collector. |
| azure.aca | log | push | 7 | planned | Container Apps logs. aisoc already deploys to ACA, so the log shape is known. |
| azure.vm | log | push | 7 | planned | Azure Monitor Agent to Log Analytics, or direct to Event Hub. |
| azure.sql | log | pull | 7 | planned | SQL Database diagnostics. |
| azure.activity | event | push | 7 | planned | Subscription activity log — the Azure analogue of CloudTrail. |
Destinations
Sinks
- elasticbuilt
- memorybuilt
- opensearchbuilt
- sentinelplanned
- splunkplanned
- stdoutbuilt
Metric stores
- memorybuilt
- remote_writebuilt
- stdoutbuilt
CMDB providers
- postgresbuilt
- servicenowbuilt
- staticbuilt