Who produced the signal?
Each sensor must be associated with an identity, tenant, and explicitly permitted origins.
Sensor Network
Trust begins before the decision.
SΛDB receives signals from heterogeneous sources, verifies their origin, and transforms them into normalized, persisted operational evidence bound to the decision process.
- RegisterSensor identity, tenant, type, and permitted origin.
- AuthenticateSensor credential verified before ingestion.
- ValidateOrigin, limits, and payload structure evaluated.
- NormalizeDifferent formats converted into a consistent event.
- PersistRaw event and normalized representation preserved.
- DecideValidated evidence delivered to the decision flow.
The problem
An alert is useful only when its origin and meaning are trusted.
Critical environments combine different sensors, tools, and protocols. Without identity, normalization, and persistence, the decision process may operate on incomplete, ambiguous, or unprovenanced signals.
What does the event mean?
Adapters convert heterogeneous formats into stable fields for correlation and decision-making.
What must be preserved?
The raw payload and normalized event maintain the link between source and the evidence used.
Ingestion controls
Six barriers before the decision process.
The pipeline applies explicit controls so a decision does not begin on an event that has not yet been validated and normalized.
Tenant-bound identity
Registration relates the sensor's type, identifier, address, metadata, and organizational scope.
API-key authentication
Ingestion verifies the credential assigned to the sensor before accepting the payload.
Permitted origin
The signal origin is checked against the authorized list for that sensor.
Rate limiting
Ingestion limits reduce abuse and protect pipeline stability.
Adapter-based normalization
The appropriate adapter converts the payload into a consistent representation.
Persistence before decision
The sensor event and operational event are persisted before the decision engine is invoked.
Supported sources
A common interface for different signals.
The module contains source-specific adapters already represented in the product. Effective availability depends on each environment's integration and configuration.
SURICATAWAZUHZEEKHONEYPOTSYSLOG
Operational evidence
The decision remains bound to the original signal.
The normalized representation provides pipeline consistency, while the raw payload preserves the provenance required for audit and investigation.
The decision start point is captured only after the validated event is fully normalized and contains the information required for decision processing.
Sensor identityAuthenticated source
TenantOrganizational scope
Event IDStable identity
TimestampEvent time
Raw payloadOriginal record
Normalized payloadDecision representation
Operational visibility
Network health and evidence continuity.
Heartbeats and operational indicators help identify online, degraded, or offline sensors and provide context for recent activity.
Sensor status
Visibility into status, last communication, and distribution across online, degraded, and offline states.
Event flow
Counts, configured geographic origin, latest event, and recent activity.
Decision integration
The operational relationship between the persisted event and the decision produced by SΛDB.
Technical demonstration
Build decisions on identified, verifiable evidence.
Explore how Sensor Network can integrate sources from your environment into the governed SΛDB flow.