Turvaandmete torustik
Safi sits between what produces your logs and what bills you for them. It reads every event, decides what it is using rules you can read, and sends the indexer only what is worth indexing. Everything else is kept, in full, where storage is cheap.
Nothing on this page is a mock-up. The rules below are a real deployment's rule set, running here in your browser, and the verdict you see is the verdict the collector gives.
Data enters on the left and leaves on the right. Click any box to find out what it is. The dots are not decoration: each one is a real event from the catalogue, classified by the real rules before it is launched, and coloured by the verdict it was given · so the mix you see flowing is the mix the rule set produces.
This is an add-on. It is built on the data hub and switched on only for a customer who asks for it · it is not part of a default deployment.
Your system asks for reduced motion, so the stream is paused. Send one event still traces a single path.
Read the three endings. Everything
reaches raw/, whatever the verdict · that is what makes the
rest auditable, and what the Replay add-on reads when an investigation needs a
week back. Only the gold path reaches your SIEM and only the gold path is
billed. The other two reach the hub, where they stay searchable at storage
prices rather than indexer prices.
Pick a log line, or paste one of your own. It runs through every stage of the chain in order, and each stage says what it did and which file decided it. 97 sample events, one for every rule the chain can assign and for the near-misses each rule was written against.
A was masked in place before any stage below saw it. The highlighted token is what replaced it.
Pick an event to see what the chain decides.
Schema drift flagged. The event is kept and marked rather than classified, because the shape changed and nothing below is trusted to judge it.
One event for every rule, plus the near misses. Watch the split settle. This is the shape of the rule set, not the shape of your traffic · one event per rule is not a sample of a day.
Why the event count is higher than the case count. A few cases stand for the same event arriving several times, which is what the aggregator exists to collapse. The meter counts events, so the collapse shows up where it belongs: as bytes that arrived and never left.
What you just watched. Every one of those events was classified by the same rules, in the same order, that run on a collector. Not one of them was deleted: the dropped ones are in the dropped archive with the rule that dropped them beside each, which is how a decision stays auditable a month later when somebody asks why an event is not in the SIEM.
This is the part that decides whether a SOC will accept volume reduction at all. Four archives are written on the collector itself, and every event is in at least one of them with the rule that decided it on the same record.
Every event, before anything collapsed it, carrying the class and the rule that decided it. This is what makes the next three auditable rather than asserted, and it is what the replay add-on reads.
The measurement. The reduction is arithmetic between this and raw/ on the collector's own disk, not a figure in a report.
Full fidelity, searchable, and off the ingest line. An event here was not judged worthless · it was judged not worth indexing at indexer prices.
The rule that dropped it, on the record. When somebody asks why an event is not in the SIEM, the answer is a lookup rather than an argument.
A log line arrives as a sentence. A SIEM charges you to store the sentence and then makes you write a regex every time you want one value out of it. Safi parses once, at the edge, and what lands downstream is typed.
Every search is a pattern match over the whole message. Field extraction happens at search time, on every search, for every analyst, forever. Two people write two regexes for the same value and get two answers.
Source, event id, action, bytes, zone, the rule that classified it and the lineage id that joins it to its own raw record. Parsed on the collector, once, before anything is written. A dashboard built on these does not break when a vendor adds a field, because drift is detected and flagged rather than silently mismatched.
Masking runs before any of it. Card numbers, credentials, bearer tokens, national identifiers, IBANs and email addresses are replaced on the collector, before classification and before the raw archive · so no copy anywhere holds the original. The shape is kept: a card keeps its last four digits and its field length, because records are parsed by counting separators and a mask that moved one would break a parser downstream. Try the Masking filter above and watch the token change.
Set your daily volume. The split applied is the one from the events you have run on this page, so the figure moves when you change what you feed it. It is arithmetic, not a benchmark, and the only honest version of this number is the one your own traffic produces.
Split from .
Three layers ship and run today. Everything after OpenSearch is an add-on: built on the same store, available when a customer asks for it, and not deployed unless they do.
Forwarders, syslog, Windows event collection, firewalls, endpoints. Safi speaks what they already send · nothing on the source side changes.
Reassemble, mask, classify, aggregate, override, route. The nine stages above. Rules are plain text files, versioned, pushed from the console.
The four archives become four indexes, typed by templates written before the first event lands, so a field is a field rather than free text. Your SIEM keeps receiving the stream it needs; this is where everything else lives, searchable and cheap.
An embedded SIEM beside the one you already run, reading from the same store. Detection and rule content on the archived estate, without putting that estate back through your licensed indexer.
Machine learning over the hub: anomaly detection on the streams you keep there. Embedded AI is a feature of the next Safi version; today this is OpenSearch's own ML working on data Safi has already made uniform.
A learned baseline per source, per host, per tenant · what this estate looks like on an ordinary Tuesday. A deviation then means something, instead of a threshold somebody guessed a year ago and nobody has revisited.
Rules, routing and delivery on top of the hub, so a condition in the archived estate can reach a person without that estate being indexed anywhere else first.
A Vector of its own that takes a time window and resends the raw archived logs downstream. You archived a week cheaply; an investigation needs it in the SIEM; you replay that window and nothing else. The raw archive is what makes it possible, and it is written whatever the verdict.
The reusable card-number and credential masking rules, as a feature for any Vector in the estate rather than only the Safi collector, and managed from the Alin Li Console.
Why these are marked as add-ons. None of them is deployed by default. They are built on the data hub and switched on for a customer who wants them, which keeps the base deployment small enough to reason about and fast enough to run many tenants on. A platform that ships everything to everyone is a platform nobody can size.
The chain assigns 42 rules from 104 patterns. The second page lists all of them · what each catches, what it decides, and the process that produces a rule and changes one.