Architecture

SATARK separates a domain-agnostic core from independent domain plugins. Telemetry is normalized into Events, then the engine runs detect → score → explain to produce Findings.

How it works

Solid neon edges are the critical path. Amber outlines mark supporting layers—rules, knowledge, graph correlation, and optional AI enrichment.

flowchart TB
  T["Raw telemetry
CSV · logs · vendor records"]
  P["Domain plugins
collect → normalize"]
  E["Events"]
  STORE["EventStore"]
  ENG["AnalysisEngine"]

  subgraph PIPE["Pipeline"]
    direction LR
    DET["detect"]
    SCORE["score"]
    EXPLAIN["explain"]
  end

  FIND["Findings
evidence · confidence · risk"]

  RULES["Rules
YARA · Sigma · STIX"]
  KNOW["Knowledge
ATTCK · CVE · CWE"]
  GRAPH["Graph
entities · attack paths"]
  AI["AI assistants
optional enrich"]

  T --> P --> E --> STORE --> ENG
  ENG --> DET --> SCORE --> EXPLAIN --> FIND
  RULES -.-> DET
  KNOW -.-> SCORE
  GRAPH -.-> FIND
  AI -.-> FIND

  classDef neon fill:#121214,stroke:#ed1c24,stroke-width:2px,color:#f4f4f5
  classDef neonHot fill:#161618,stroke:#ff6b72,stroke-width:2px,color:#f4f4f5
  classDef neonAmber fill:#121214,stroke:#e0b35a,stroke-width:2px,color:#f4f4f5
  classDef neonOut fill:#1a0a0b,stroke:#ff4d54,stroke-width:2.5px,color:#fff5f5

  class T,P,E,STORE,ENG,DET,SCORE,EXPLAIN neon
  class FIND neonOut
  class RULES,KNOW,GRAPH,AI neonAmber
  class PIPE neonHot

  linkStyle default stroke:#ff4d54,stroke-width:2px

End-to-end flow: plugins normalize telemetry; the core stores Events and runs the analysis pipeline; supporting modules feed detection, scoring, and outputs without owning the critical path.

Working demo

Live CLI run of the insider plugin against sample USB/file telemetry—listing plugins, then producing explainable elevated findings.

SATARK CLI listing built-in plugins and starting insider analysis on sample CSV data — `satark list-plugins` then `satark analyze -p insider` on `examples/data/sample_insider.csv`.

SATARK CLI findings table showing anomalous USB and file activity for alice with explainable risk scores — Elevated findings: USB spike (risk 1.00) and file spike (risk 0.90) with score factors and rule IDs.

Reproduce locally after uv sync --group dev: ./scripts/demo_insider.sh or uv run satark analyze -p insider -d examples/data/sample_insider.csv --threshold 0.5.

Core invariants

Everything becomes an Event before scoring
The core stays domain-agnostic
Plugins never import each other
Detections remain reproducible without AI
Scores carry factors, evidence, confidence, and references

Where to dig deeper

Package layout, API details, and plugin contracts live in the docs: Architecture guide, Plugins, Scoring, and Findings.

Example domain plugin today: insider (behavioral USB / file-spike signals).