Bundles build seriesbundleopen sourcesecurity programme

Open SOC Architecture + Build Foundation

The Open SOC Reference Architecture plus Build Series Volumes 02, 01 and 06 — the system-level design, then the three planes everything else depends on.

The Open SOC Reference Architecture tells you what the machine looks like and where the load-bearing decisions are. The Foundation volumes build the three parts of it that everything else depends on.

Pillar 04 — The Open SOC Reference Architecture. Six planes, 24 components with verified licences and named replacements, an AI analyst plane with a defensible autonomy ceiling, and three sized builds.

Vol. 02 — Asset Inventory & Discovery, Vol. 01 — Detection & Monitoring, and Vol. 06 — Identity & Access.

Read the architecture first for the shape of the system, then build in the order 02 → 01 → 06.

What's in this bundle

Security Program Pillars 10 pages

Pillar 04 Companion — The Open SOC Reference Architecture

The open-source SOC diagram everyone shares has two commercial products on it. This is the corrected version — six planes, 24 components with verified licenses and named replacements, an AI analyst plane with a defensible autonomy ceiling, and three sized builds with honest hour counts.

Architecture & Build 9 pages

Build Series Vol. 02 — Asset Inventory & Discovery

Discovery tells you what is out there. The source of truth holds what you have decided about it. The control lives in the reconciliation between them, not in either list.

Architecture & Build 9 pages

Build Series Vol. 01 — Detection & Monitoring

Wazuh, Suricata and Zeek assembled into a stack one person can operate, with the tuning and detection validation that almost every deployment skips.

Architecture & Build 9 pages

Build Series Vol. 06 — Identity & Access

One front door, authenticators that survive phishing, privileged identities separated from daily work, and access that genuinely ends when people do.