Skip to content
LEGIT AIDOCS
Open the console

Architecture Center

How Legit AI is built: the parts of the platform, how an event becomes a decision, where data comes from, how it is deployed and how it is secured.

How Legit AI is built, drawn part by part. Everything in these drawings exists in the platform today; what it does not do is listed in Facts and evidence.

Legit AIOne platform, one server, from a sensor to a decision
One server, one SQLite databaseNothing leaves without your sayEventsDecisions written backWindows agentSSH collectorSyslog 514Ingest APIPacket captures01 SourcesNormaliseRulesFileless heuristicsBehaviour baselineKill chain02 DetectionAlertsAssetsIndicatorsInvestigationsAttack paths03 Findings, graphTriageAI analystPlaybooksApprovalsResponse04 DecisionsAnalystApprover
Legit AI
  • Events and detections
  • Decisions by people
  • Boundary
  • Part of the platform

Reading the drawing

Section titled “Reading the drawing”
  • 01 Sources. Agents, collectors and receivers bring events in. See Data plane.
  • 02 Detection. Each event is put on one schema and checked by four layers: rules, fileless-malware heuristics, the behaviour baseline and kill-chain correlation.
  • 03 Findings and the graph. What detection finds becomes alerts, tied to assets, indicators and investigations.
  • 04 Decisions. People triage, approve and respond, and the AI analyst explains. Their decisions are written back. See Detection loop.

The red dashed line is the server’s boundary. All four parts run on one server with one SQLite database, and on your own server nothing leaves it unless you allow it.

01Architecture mapTwelve numbered parts: what each holds and how they connect.Open02Detection loopEvents read into the graph, decisions written back.Open03Data planeThirty-three kinds of record the platform reads, and how each arrives.Open04DeploymentLegit AI cloud and the air-gap kit, side by side.Open05SecurityFive layers of controls and the air gap around them.Open