Cyberpedia Security Platform: Architecture for an AI-Powered SOC

Most organizations in Syria cannot afford or access global security products, which leaves them without asset visibility, vulnerability tracking, or centralized monitoring. I set out to design an in-house, affordable security platform for the local market that grows step by step into a complete SOC, with each capability delivered as its own product on an open-source foundation.

I led the full technical design and wrote the architecture document (CP-ARCH-001), covering: A five-module roadmap: asset inventory → vulnerability management → SIEM → SOAR → AI layer Asset inventory: agent protocol, network discovery, and asset deduplication logic Vulnerability management: correlation against NVD, OSV, CISA KEV and EPSS, with signed offline feed bundles for low-connectivity sites SIEM: comparison of a Wazuh-based track versus a custom stack SOAR: workflow automation with Temporal and a playbook language AI layer: local-first LLM with RAG to support analysts Data model and SQL schema, API contract, threat model, deployment sizing, license matrix, team structure, risks, and a phased roadmap with acceptance gates

Delivered a complete architecture blueprint (18 sections plus 3 appendices) that serves as the build reference for the platform. It defines a realistic, low-cost path from basic asset visibility to a full AI-supported SOC for organizations that cannot buy global solutions, and sets the next milestone: a detailed specification for the asset inventory module.

• SOC Architecture
• SIEM
• Wazuh
• SOAR
• Vulnerability Management
• Asset Inventory
• Threat Modeling
• Temporal
• LLM RAG
• PostgreSQL

• https://books.cyberpedia.site/ (opens in a new tab)