Architecture
How ClearSOC is built, and what it does when a part fails.
Two services and one PostgreSQL database, hosted on Railway in the US. ClearSOC reads your accounts on a schedule and installs nothing on your side.
- Microsoft 365
- Google Workspace
- Okta
- AWS CloudTrail
- and 6 more
Acted on, not read
Palo Alto NGFW or AWS WAF, for Block IP
ClearSOCRailway, US
Intelligence
Worker, ingestion pool
Reads each source, maps it to one event shape, runs your rules
Analyzes each incident
The app you sign in to
- Incidents, live
- Approvals
- The audit log
Data infrastructure
- security_events
- incidents
- approvals
- audit_logs
- job queue
Cache, live updates
Controlled response
9 types, 6 reversible. Run after a person approves, or where your ARGUS setting allows.
Claude, called by ARGUS
The ClearSOC app
Approves or refuses what ARGUS staged
Alerts can also go to Slack, PagerDuty, Opsgenie, Jira or ServiceNow
Dashed outlines are trust boundaries, whose systems these are. Every line runs the way data moves.