Skip to content
LEGIT AIDOCS
Open the console

Architecture map

Legit AI in twelve numbered parts: what each holds and how they connect.

The whole platform on one page. Red lines carry events and what detection finds, green ones carry decisions people make, amber marks what waits for a second person.

Architecture mapTwelve parts and how they connect
Legit AI architecture01Sources and sensors02Ingest andnormalisation03Threat intelligence04Detection05Findings and entitygraph06Triage07AI analyst08Investigations09Response10A person decides11Security andgovernance12Deployment and storageeventsindicatorsexplainsescalateactwaits1Sources and sensorsWindows agentSSH collectorSyslog 514Ingest APILog filesPacket capturesRouter readAWS IAM2Ingest and normalisation▪ One schema: legit.event.v1▪ The server keeps its own receivetime▪ What cannot be read goes to adead-letter queue3Threat intelligence▪ Signed offline bundles▪ Your own indicators andknown-good▪ Online feeds only where allowed4DetectionRulesFileless heuristicsBehaviour baselineKill chainMulti-step correlation5Findings and entity graphAlertsAssetsIndicatorsRelationshipsAttack paths6Triage▪ Confirm, dismiss with a reason,escalate▪ Duplicates join one alert▪ Every change in the audit log7AI analyst▪ A local model explains from theevidence▪ It does not detect▪ Marked when the fallbackanswers8Investigations▪ Cases, the board, evidence▪ Timeline and attack path9ResponsePlaybooksIsolate hostStop processQuarantine fileBlock addressSecure terminal10A person decides▪ A second administratorapproves,▪ or one person with a fresh code11Security and governanceOrganisation boundaryTwo-factorStep-up codesSigned agent commandsHash-chained auditAir-gap egress gate12Deployment and storageOne serverSQLite in WAL modeNightly backupsCloud or air-gap kitSigned updates
Legit AI
  • Events and detections
  • Decisions by people
  • Waits for approval
  • Part of the platform

The twelve parts

Section titled “The twelve parts”
Part Read more
1 Sources and sensors Connect data sources, Enroll a Windows endpoint, Monitor Linux servers over SSH
2 Ingest and normalisation How Legit AI works, Send events
3 Threat intelligence Threat intelligence and the knowledge base, Update rules and intelligence offline
4 Detection How detection works, Detection rules
5 Findings and entity graph Attack path and the entity graph
6 Triage The alert queue
7 AI analyst The AI analyst
8 Investigations Investigations
9 Response Playbooks, Isolation and process kill, Secure terminal
10 A person decides Isolation and process kill
11 Security and governance Security
12 Deployment and storage Deployment, Run Legit AI on your own server