This document describes the stable deterministic path used by Azazel-Edge to convert edge telemetry into explicit operator-facing actions.
- Event input (for example Suricata EVE and local probes) is received.
- Inputs are normalized into Evidence Plane records.
- NOC and SOC evaluators score state deterministically.
- Policy thresholds are applied.
- Action Arbiter selects one bounded action.
- Decision Explanation is generated with rationale and alternatives.
- Notification and optional AI assist are executed post-decision.
- Audit logging records the full trace.
| Component | Status | Notes |
|---|---|---|
| Evidence normalization | Implemented | Evidence Plane schema and bus are part of runtime baseline. |
| Deterministic evaluators | Implemented | NOC and SOC remain separate evaluators. |
| Policy-based action selection | Implemented | Arbiter action set is bounded. |
| Reversible control posture | Implemented | Actions are explicit and operator-reviewable. |
Reproducibility metadata (config hash) |
Planned | Partial support exists; full packaging across all outputs is still maturing. |
- Deterministic path remains authoritative.
- AI assist is optional and invoked only after deterministic decision stages.
- Fail-closed defaults are retained for protected API behavior.