S³ Stack Architecture: End-to-End Security Data Flow
S³ Stack monorepo with MCP servers, playbooks, and deployment automation
This is the architecture deep-dive for a production Security Operations Center built entirely with open-source tools. While the companion project page covers the deployment and institutional value, this page focuses on one thing: how data moves through the stack from the moment a packet hits the wire to the moment an analyst closes an incident case.
What makes this architecture distinctive is the AI integration layer. Nine MCP (Model Context Protocol) servers expose every tool in the stack to LLM-powered assistants. The result is a SOC where natural language is a first-class interface, and an AI can query alerts, create cases, run enrichment, and check threat intel in a single conversation.
Each tool serves a specific role in the data flow pipeline:
Parses network traffic into structured JSON logs: HTTP requests, DNS queries, TLS handshakes, file transfers. Provides deep metadata that signature-based tools miss.
Matches network packets against thousands of known attack signatures. Outputs eve.json alerts for confirmed threats like exploit attempts and malware downloads.
Central nervous system. Collects logs from all endpoints and NIDS sensors, correlates events against MITRE ATT&CK rules, generates alerts, and triggers escalation workflows.
Case management hub. Receives high-severity alerts from Wazuh, organizes them into investigation cases with tasks, observables, and analyst assignments.
Runs automated enrichment on extracted indicators (IPs, hashes, domains). Queries VirusTotal, AbuseIPDB, and other sources via containerized analyzer plugins.
Stores and correlates Indicators of Compromise across threat feeds. Answers the critical question: have we seen this indicator before, and in what context?
Elasticsearch fork that stores all SIEM data long-term. Powers the dashboard queries and provides the searchable archive for historical analysis.
Model Context Protocol servers that expose every SOC tool to LLM-powered assistants. Natural language becomes a first-class interface for security operations.
Follow a suspicious packet from the wire to a closed case. Every arrow represents an automated, API-driven handoff with no manual intervention required.
Here is what happens when a compromised endpoint attempts a Command and Control callback:
The NIDS VM receives mirrored traffic via the SPAN port. Suricata matches the outbound connection against its ET Open ruleset and flags it as a known C2 signature. Simultaneously, Zeek logs the full connection metadata: source IP, destination IP, port, duration, bytes transferred, and TLS certificate details.
A Wazuh Agent on the NIDS box reads the Suricata eve.json and Zeek conn.log files, ships them to the Wazuh Manager via TCP/1514. The Manager decodes the logs, matches them against MITRE ATT&CK rules (T1071: Application Layer Protocol), and generates a high-severity alert. The alert is indexed in the Wazuh Indexer for long-term storage and dashboard visibility.
The custom-w2thive.py script on the Wazuh Manager detects the alert exceeds the severity threshold. It transforms the alert into TheHive's expected JSON schema and POSTs it to the TheHive API on port 9000. TheHive creates a new alert entry, ready for analyst review.
An analyst (or the AI assistant via MCP) promotes the alert to a full case. TheHive extracts observables: the destination IP, domain, and any file hashes. These observables are sent to Cortex, which runs containerized analyzers against VirusTotal, AbuseIPDB, and the local MISP instance. Enrichment reports flow back into the case automatically.
MISP checks the observables against its threat feed database. The destination IP appears in three separate threat reports linked to a known APT group. This context is attached to the TheHive case, giving the analyst (or AI) the full picture: what happened, how bad it is, and who else has seen it.
With full context in hand, the analyst documents findings, assigns response tasks (isolate host, block IP at firewall, scan for lateral movement), and closes the case. The IoCs are exported back to MISP to strengthen future detection. Total elapsed time from packet to enriched case: under 60 seconds.
Nine MCP servers transform the entire SOC stack into a conversational interface. Each server wraps a platform's REST API into structured tools that any LLM can invoke.
Query alerts, search events, check agent status
Create cases, manage tasks, search history
Run analyzers, retrieve enrichment reports
Search IoCs, correlate threat intel, query feeds
Search connection logs, DNS queries, HTTP metadata
Query signature alerts, rule management
Raw index queries, historical data search
Search and convert detection rules across formats
Retrieve and analyze stored network captures
// What This Looks Like in Practice
- Multi-tier SOC design
- Defense-in-depth strategy
- API-driven integration
- Data flow optimization
- SPAN/mirror port config
- Dual NIDS deployment
- Protocol analysis
- Signature management
- Log correlation rules
- MITRE ATT&CK mapping
- Alert threshold tuning
- Custom decoder writing
- Case management workflows
- Observable enrichment
- Threat intel correlation
- Automated triage
- MCP server development
- API abstraction layers
- Tool-use patterns
- Natural language interfaces
- Proxmox virtualization
- VLAN segmentation
- JVM tuning
- Docker orchestration
- ✓ Full SOC stack deployed and integrated
- ✓ Dual NIDS (Zeek + Suricata) monitoring network
- ✓ Wazuh SIEM with MITRE ATT&CK correlation
- ✓ Automated Wazuh-to-TheHive alert escalation
- ✓ Cortex enrichment with external analyzers
- ✓ MISP threat intel feeds active
- ✓ 9 MCP servers providing AI access to all tools
- ✓ End-to-end data flow validated