01
Security data
Authorized telemetry from logs, cloud, endpoint, identity and other approved sources.
How intelligence becomes action.
An operational view of how Harpia processes, relates and contextualizes authorized security evidence.
Operational pipeline
Evidence moves through explicit analytical stages.
02
Ingestion & normalization
Events are validated and brought into consistent structures so relationships can be evaluated.
03
Analysis
Detection, behavioral, anomaly and threat-intelligence methods are applied according to maturity.
04
Correlation
Related evidence is connected to reduce isolated alerts and assemble analytical context.
05
Risk & decision
Evidence and operational context support prioritization and explicit decision workflows.
06
Response
Human-led or policy-controlled actions may follow when appropriate integrations exist.