I designed the GENESIS platform as a five‑stage pipeline that ingests six log source types, normalizes them, runs five deterministic detection engines plus a correlation engine, stores results with an append‑only SHA‑256 hash chain, and exposes a Security Copilot UI built with React 18 and Tailwind.
- Ingestion Layer (Stage 1) handles OpenSSH auth.log, Linux PAM/Syslog, Okta Identity (JSON/JSONL), Network Flows (NetFlow/PCAP), WAF & Web Access Logs, AD Kerberos Tickets (4768/4769).
- Detection Layer (Stage 2) normalizes to SecurityEventModel and runs SSH Brute‑Force, Password Spraying, Distributed Attack, Auth Anomaly, and Compromise Detection engines; results feed the Incident Correlation Engine for severity & risk scoring.
- Persistence Layer (Stage 3) stores events in PostgreSQL 16 or SQLite WAL via SQLAlchemy 2.0 Async and writes an append‑only SHA‑256 hash chain (H_i = SHA256(H_{i‑1} || E_i)).
- Intelligence Layer (Stage 4) provides a Security Copilot UI (React 18 + Tailwind) that talks to a FastAPI chat router (/api/v1/chat) streaming via REST & SSE to the ChatCopilotService’s 6‑Stage Cognitive Pipeline.
- Orchestration Layer (Stage 5) enforces PolicyEngine guardrails (e.g., PB‑SSH‑BRUTE‑01, PB‑WEB‑SQLI‑01) with a Protected Subnet Check (RFC 5737 / Internal VLAN) before proposing response actions that are executed by an Executor (iptables, Session Revoke, Sinkhole) with a One‑Click Rollback Handler.
I chose the Drain algorithm for log template extraction because it works across heterogeneous sources, and I store data in PostgreSQL 16 for production workloads while also supporting SQLite WAL for lightweight deployments.