RA-01 — The Open SOC Reference Architecture

The conventional open-source SOC diagram is a bill of materials arranged in columns, and it has been essentially unchanged since about 2019: collectors on the left, Wazuh and Suricata in the middle, TheHive and MISP on the right, "100% Open Source" along the bottom. It does not survive a license check.

Three things changed underneath it, and each changes the architecture rather than just the component list. The licensing floor moved — components that were open source when it was drawn are not open source now, so a service provider inheriting the diagram inherits a compliance problem. The storage layer split — hot detection storage and long retention are separate decisions now, and treating them as one is the largest single driver of open-source SOC cost overrun. And the analyst tier became addressable, which is the constraint that actually kept small teams from using any of this.

Six planes, ordered by ownership rather than dataflow. Collection, Pipeline, Store, Decision, Action, Governance. The conventional four-column layout hides the two planes where the difficulty lives: Pipeline, where 40–70% of raw volume is cut before it reaches paid storage and where the tenant identifier is attached, does not appear on it at all. Governance appears as a "Principles" box in the corner with no wiring attached.

The license truth table — the section to read first. Every one of 24 components carries a license, a version, and a currency note, verified with dates in August 2026. Entries that fail carry a named replacement: TheHive 5 is proprietary and drops to read-only without a StrangeBee license (there is a separate MSSP license for exactly the use case the diagram depicts) → DFIR-IRIS, LGPLv3. OTRS Community Edition lost security fixes on 1 January 2021 with eight days' notice → Znuny or OTOBO. HashiCorp Vault moved to BUSL → OpenBao, MPL 2.0. Fine to buy any of them; not fine to put them behind a "100% Open Source" badge.

An AI analyst plane with a ceiling you can defend. The open-source SOC always failed the same way — it works, then produces more alerts than anyone has time to read, then gets quietly ignored while still appearing on the compliance evidence. Covers the self-hostable options (Vigil, Apache 2.0; AiSOC, MIT; agentic-soc-platform), a five-rung autonomy ladder from L0 Enrich through L3 reversible action, the evidence ledger that makes every automated disposition replayable, and five guardrails. You move up a rung on a measured error rate over an agreed sample size, never on a calendar. L4 autonomy is explicitly not in this architecture.

Three sized builds with the hour counts stated. Tier 1 single node (under ~100 endpoints, 20–30 hours to build, 3–5 hrs/week to operate, $1.2–4k/yr). Tier 2 split planes (150–1,000 staff, 120–200 hours, 0.5–1 FTE, $8–48k/yr). Tier 3 multi-tenant (400+ hours, 1 FTE plus analysts, $30–120k/yr) — with the viability floor stated plainly at 8–10 clients, because that is the number that decides whether a practice builds or buys.

Also includes a six-test validation harness where each test produces an artifact, an honest total-cost model with the labor line left in, a seven-layer tenancy model, an AI prompt pack, and five buy lines — the situations where the honest answer is to stop and buy MDR instead. A DIY document that never tells you to stop is a sales document.