Skip to content

README.md

Latest commit

 

History

History
122 lines (91 loc) · 2.23 KB

README.md

File metadata and controls

122 lines (91 loc) · 2.23 KB

security-alerting-framework

A sanitized, public-facing reference architecture for routing security events through a serverless edge worker, enriching suspicious indicators, and conditionally escalating alerts using Slack.

This repository contains no production secrets, URLs, or internal identifiers. It demonstrates architecture patterns only.

Overview

Event Source (Firewall / Edge / API) ↓ Serverless Router (Edge Worker Pattern) ↓ Primary Alert Channel (Slack) ↓ Conditional Threat Intelligence Enrichment (Threaded Reply) ↓ Escalation Channel (if risk threshold exceeded)

Design Goals

  • Low-noise alerting
  • Threshold-based enrichment
  • Threaded contextual intelligence
  • Minimal state using KV-style memory
  • Separation between routing and enrichment layers

Core Components

Event Router

  • Accept authenticated POST events
  • Normalize payload structure
  • Extract indicators (IP or domain)
  • Post base alert to Slack
  • Invoke enrichment service

Threat Intel Service Pattern

  • Accept indicator via POST /enrich
  • Return structured risk data:
    • score
    • country
    • ASN / org
    • privacy flags

Conditional Escalation

  • Thread enrichment when score >= 40
  • Escalate when score >= 70

7-Day Indicator Memory

Tracks:

  • first_seen_ms
  • last_seen_ms
  • count_7d
  • last_score
  • last_country

Example Event

{ "type": "abnormal_upload", "device": "Endpoint-01", "message": "Outbound data to 8.8.8.8", "timestamp": "2026-03-01T14:00:00Z" }

Example Enrichment Response

{ "ok": true, "score": 55, "country": "NL", "org": "Example Hosting Provider", "privacy": { "hosting": true, "vpn": false, "tor": false } }

Scoring Reference

Allowlist example: US, CA, GB, AU, NZ

Modifiers (illustrative): +30 Geo outside allowlist +15 High-risk alarm type +15 Repeat indicator (>=3 in 7 days) +10 First time seen

Thread threshold: 40 Critical threshold: 70

Technology Pattern

  • Edge compute (Workers model)
  • Slack Web API
  • KV-style memory
  • JSON service authentication

Production Hardening (Not Included Here)

  • Secret bindings for tokens
  • Strict header validation
  • Rate limiting
  • Structured logging
  • Environment separation