How ARIA Detects, Triages, and Responds.

Endpoints (Sysmon/FIM/YARA) and cloud tenants feed Wazuh. The ARIA engine pulls alerts every cycle and a 2-hour dedup guard drops exact duplicates before anything else runs.

Five git-reviewed rules auto-close known-benign alert classes instantly — zero AI calls, no verifier, nothing queued for triage. Only novel or unrecognised alerts proceed.

Before any AI sees the alert, ARIA queries the Wazuh indexer for every event within ±1 hour on the same agent (SIEM Neighbor Pull). Google Workspace alerts also get an oauth_client_id lookup from the token table. In parallel, four external intel feeds run: CISA KEV, OTX, VirusTotal, and AbuseIPDB. All results merge into a context bundle before triage.

The enriched context bundle goes to L2: Claude Haiku 4.5 for standard alerts, Sonnet for severity ≥13. Groq 70B then a local Ollama instance are automatic fallbacks if the Claude API is unavailable. The model returns a structured verdict with reasoning and a claim list.

A deterministic Sufficiency Gate first checks whether the neighbor pull returned enough log context — alerts with thin evidence are held for re-check. If context is sufficient, Groq (never Claude) independently judges the verdict. Cross-family verification is a hard rule. The gate then routes to close, escalate, or hold.

Playbooks fire automatically on MITRE technique match. Destructive steps — process kill, endpoint quarantine, network isolation — require explicit Telegram approval before Wazuh executes them on the affected endpoint.

Every verdict, trace, and response action persists in Supabase with row-level security per tenant. Decisions surface on the SOC board in real time and roll into monthly PDF compliance reports via Puppeteer and Resend.

Off the per-alert path: nightly threat hunts (03:00), IOC sweeps against CISA KEV and OTX (03:30, no AI), batch re-verification of prior verdicts (02:00), self-healing diagnostics, and on-demand L3 deep-dive investigations.