SOC Backend
Repo: AnyOne-SOC-Backend (Rust, axum). The HTTP API and orchestration service behind the SOC
dashboard, and the endpoint’s command/enrollment counterpart. A single axum binary
(anyone-soc-backend), Postgres-backed (schema soc), with best-effort Kafka consumers and
producers. This is where operator intent becomes a signed endpoint command, and where enrollment
and trust-bundle distribution are driven.
Detection/correlation — turning raw
ocsf-eventsintooutput.sigmaalerts — happens upstream and is out of scope; this service consumes the results, not raw telemetry.
Component view
Layering
Strict api/ → services/ → repository/, with domain/ pure types and middleware/ extractors
(src/api/v1/mod.rs). Boot order (src/main.rs): config → PgPool → migrate → seed admin → spawn
Kafka consumers → serve. Axum 0.8, sqlx 0.8, JWT HS256 + argon2, utoipa/Swagger.
Kafka topics
| Topic (default) | Dir | Purpose |
|---|---|---|
output.sigma | consume | SIGMA-detection alerts → Postgres → SSE. |
uba.anomaly.detected | consume | UBA anomalies (Confluent protobuf via Schema Registry). |
endpoint.enrollments | consume | Device enrollments — sole writer of soc.endpoints. |
commands.response | consume | CommandResult acks from the gateway. |
commands.endpoint | produce | Signed operator commands. |
endpoint.enrollment-responses | produce | Trust-bundle blob keyed by endpoint_id. |
rule_updates | produce | Rule lifecycle events. |
Kafka is optional/best-effort. Note it does not consume ocsf-events — alerts arrive
already-detected on output.sigma.
Command dispatch & signing
POST /api/v1/commands (admin) → services/command_dispatch.rs. Builds PROCESS_KILL /
HOST_ISOLATION / FILE_QUARANTINE (domain/command.rs), Ed25519-signs the canonical bytes via
services/signing.rs LocalSigner, publishes to commands.endpoint keyed by endpoint_id
(acks=all, idempotent), and persists soc.command_history. The signing key is loaded in-process
from COMMAND_SIGNING_PRIVATE_KEY_BASE64 (id COMMAND_SIGNING_KEY_ID, default k1) and embedded as
sig_key_id. Gated by COMMAND_DISPATCH_ENABLED (503 otherwise). Signer is a trait, so a KMS
backend can drop in later. See Command Trust.
Trust bundle — hold / validate / distribute (not mint)
The backend ingests a pre-signed bundle from COMMAND_TRUST_BUNDLE_BASE64
(domain/trust_bundle.rs); the anchor private key stays offline and the backend never signs
bundles. At startup it validates that the bundle advertises the active COMMAND_SIGNING_KEY_ID with
a matching public key, or fails fast. On every enrollment it republishes the blob to
endpoint.enrollment-responses keyed by endpoint_id; the gateway forwards it down so endpoints
build their command-verifier key set. Monotonic version gives downgrade protection (enforced
endpoint-side).
Enrollment
enrollment_consumer is the sole writer of soc.endpoints (integrity check that endpoint_id
matches the SHA-256 of the presented public key). One-click issuance
POST /api/v1/bootstrap/enrollment/issue (admin) signs a per-device ECDSA P-256 leaf in process
(services/enrollment_ca.rs; the CA key is age-encrypted at rest) and returns a one-time claimable
link that renders the enrollment .bat. The enrollment CA itself is created offline; mTLS is
terminated at the Gateway against step-ca-signed certs. See
Enrollment.
Other subsystems
SIGMA→OCSF normalizer + custom-rule CRUD; container/system observability (Prometheus, docker-socket-proxy); G-Bridge CACAO playbook proxy; Neo4j ATT&CK knowledge-graph explorer; SSE alert stream. External deps: Postgres, Kafka (+ optional Schema Registry), G-Bridge, Neo4j, Prometheus.
Offline provisioning (not in this repo)
Trust-bundle minting (offline anchor key) and the IOC filter build remain standalone offline
ops steps — this backend only consumes their outputs (a pre-signed bundle; a populated
ioc_hashes set).