Technical-Executive Brief · 2026 · v7.0
Detection & Response Fabric · H&I Balam SOC
Security operations platform that converts alerts into actions with automatic correlation, AI analysis, n8n automation and unified incident management.
Version 7.0 — August 2026 Language English Classification Confidential Contact soporte@obsidia.center
01 · Executive Summary
What is OBSIDIA?
OBSIDIA is an operational security platform (SOC-as-a-Service) that integrates threat detection, artificial intelligence analysis, n8n workflow automation and incident management in a single solution. Designed for organizations that need enterprise-level security visibility in Latin America — MX, BR, CO, AR, CL and the rest of the region.

Continuous Detection

24/7 monitoring of security events across all infrastructure agents, with automatic correlation and prioritization by risk level and MITRE severity.

AI Analysis — MITRE ATT&CK

Every critical alert is analyzed by the integrated AI engine to identify the MITRE tactic, potential impact and recommended remediation actions with full context.

n8n Automation

Native automation layer with specialized endpoints: real-time Telegram alerts, automatic daily reports, spike detection, playbook generation and multi-level escalation chains.

Incident Management

Automatic creation of enriched tickets in osTicket, Jira Service Management or ServiceNow. Every incident is documented, assigned and traceable with full AI analysis.

AI Playbooks On-Demand

Instant generation of response playbooks for active incidents. The AI engine produces actionable containment, investigation and documentation guides tailored to the detected threat.

Executive Visibility

Real-time dashboard with operational metrics, SSE event feed, risk indicators and automatic reports for regulatory compliance audits.

Network Visibility

Perimeter traffic aggregated by the minute: allowed and blocked sessions, bandwidth split by upload and download, destination countries and applications in use — without storing the raw logs.

VPN Access Control

Who connects over VPN, from which country and with which assigned address. Rejected attempts are logged with their origin, and access granted after repeated failures raises an immediate alert and opens a ticket.

02 · Architecture
Component Diagram
OBSIDIA acts as an orchestration layer over multiple security sources. A unified Normalizer converts alerts from any source to the OBSIDIA standard format before processing. The n8n automation layer consumes API endpoints to trigger notifications, escalations and playbooks without manual intervention. All components run in isolated Docker containers.
CLIENT INFRASTRUCTURE OpenSearch Indexer · :9200 · TLS SIEM Externo API · syslog · REST EDR / Cloud Logs agentes · API · webhooks Normalizador rule · agent · mitre · level dedup · state · fingerprint → OBSIDIA standard format OBSIDIA Core ▸ MITRE ATT&CK Mapping ▸ Kill Chain Analysis ▸ Motor IA — análisis contextual ▸ Poller Engine · Dedup SHA-256 ▸ Event Store (PostgreSQL) ▸ Heartbeat · Licenses · SLA poll: 20s · batch configurable Ticket Dispatcher (routes by config · enriched body) osTicket self-hosted Jira Service Mgmt ServiceNow ITSM VISUALIZATION & AUTOMATION Dashboard SSE monitor.obsidia.center events + playbooks in real time Admin Portal admin.obsidia.center clients · licenses · capacity n8n Automation ▸ Telegram notifications ▸ SLA · Agentes · Spikes ▸ Playbooks · Reports ▸ Multi-tier Escalation LEGEND Synchronous flow API / async n8n webhook
03 · Operation Flow
From event to incident in 6 steps
OBSIDIA automatically orchestrates the entire detection-response cycle. The SOC team receives already-enriched tickets and actionable Telegram alerts, without manual correlation work.
01

Collection — Security Sources

Security sources — agents on servers and endpoints, OpenSearch indexers, external SIEMs and cloud logs — send events to the Normalizer. Supports multiple protocols: REST API, syslog, webhooks and direct OpenSearch queries.

02

Normalization — OBSIDIA Standard Format

The Normalizer converts heterogeneous events to the OBSIDIA standard format (rule · agent · mitre · level · dedup · state · fingerprint). The Poller Engine deduplicates by SHA-256 fingerprint and maintains state per 20-second cycle. Each adapter is independent.

03

AI Analysis — MITRE ATT&CK + Kill Chain

Alerts with level ≥ 7 (configurable per plan) are processed by the integrated AI engine. It identifies the MITRE ATT&CK tactic and technique, the corresponding Kill Chain phase, the potential impact and generates actionable remediation recommendations with full context.

04

Automatic enriched ticket creation

The Dispatcher builds a ticket with a structured subject (severity · rule · agent) and an enriched body including: event data, full AI analysis, MITRE context and remediation steps. Supports osTicket, Jira Service Management and ServiceNow.

05

n8n Automation — Notifications and Escalation

The n8n layer consumes API endpoints to trigger real-time Telegram alerts, detect volume spikes, verify SLA, monitor agent availability and generate response playbooks. Multi-level escalation chains (tier1 → tier2 → tier3) progressively notify based on configurable response time.

06

Real-time visibility and metrics

Every event is recorded in the Event Store (PostgreSQL). The SSE Dashboard transmits it in real time to the SOC team. The analyst can mark alerts as False Positive, Acknowledged or Resolved directly from the monitor — the action is recorded and automatically closes the ticket in the integrated ITSM system.

04 · n8n Automation
Native Automation Layer
OBSIDIA exposes a dedicated REST API for n8n flows that automates notifications, escalations, reports and incident response. Endpoints are protected by authentication and designed to operate in flows without human intervention.
Available today
Endpoint Function Description Status
/api/n8n/sla-breach SLA Breach Monitor Open alerts that exceed the plan SLA. Trigger for automatic escalation and analyst notification. Live
/api/n8n/agent-status Agent Offline Alert Agent status without heartbeat in the last N minutes. Excludes the internal wazuh.manager agent to avoid false positives. Live
/api/n8n/daily-summary Daily SOC Summary Daily activity summary: total alerts, severity distribution, review rate and response metrics. Basis for the automatic Telegram report. Live
/api/n8n/alert-spike Alert Spike Detector Detection of anomalous alert volume compared to the client's historical average. Trigger for immediate review or coordinated incident investigation. Live
/api/n8n/fp-rate FP Rate Monitor False positive rate per client in a configurable time window. Useful for rule optimization and correlation threshold adjustment. Live
/api/n8n/playbook-generate Playbook Generator On-demand AI playbook generation for active incidents. Receives the alert context and returns a structured containment, analysis and documentation guide. Live
/api/n8n/source-usage Capacity Monitor Capacity usage per client: active FW/UTM vs. plan limit, monitored assets vs. contract. Trigger for capacity control alerts. Live
Roadmap — Upcoming releases
Endpoint / Module Function Description Status
/api/n8n/escalation-config Multi-tier Escalation Per-client configurable escalation chain: tier1 → tier2 → tier3 with analyst IDs and delays in minutes. n8n Wait nodes ensure the interval before escalating to the next level. Roadmap
/api/n8n/monthly-report Compliance Report Automated monthly compliance report: alerts by MITRE tactic, response rate, SLA met/missed, open/closed incidents. PDF or JSON format for executive presentation. Roadmap
channels_json extendido Slack / Teams Relay Extension of the notification channel to send alerts to Slack and Microsoft Teams webhooks in addition to Telegram. Configurable per client and per alert type. Roadmap
auto_assign_rules Auto-assignment Automatic ticket and case assignment rules by alert type, severity, affected agent or MITRE tactic. Reduces first contact time without manual intervention. Roadmap
n8n → VirusTotal / AbuseIPDB IOC Lookup Enrichment of indicators of compromise (IPs, domains, hashes) by directly querying VirusTotal and AbuseIPDB from n8n flows, without additional backend. The result is attached to the corresponding ticket. Roadmap
05 · AI Playbooks
Guided Incident Response
When an active incident is detected, the SOC analyst can request a playbook generated by the AI engine from the Dashboard. The playbook is immediately actionable — not a generic guide, but a response tailored to the specific detected threat.

🔍 Identification and Context

The AI engine receives full incident context: triggered rule, affected agent, MITRE tactic, severity and related events in the time window. No client data exposed in shared environments.

🛑 Immediate Containment

Containment steps specific to the detected threat: network isolation, session revocation, process or account blocking. Ordered by minimum operational impact.

🔬 Investigation and Analysis

Forensic investigation guide: artifacts to collect, logs to review, recommended tools and key questions to determine the actual scope of the incident.

📄 Documentation and Closure

Incident documentation structure, closure criteria, post-incident remediation actions and control improvement recommendations to prevent recurrence.

Security note: Playbooks generated in the OBSIDIA shared environment use exclusively generic contextual threat information (MITRE tactic, event type, severity). They never include client internal hostnames, private IPs, usernames or credentials — ensuring that the generated content is safe to operate in a multi-tenant infrastructure.
06 · Technical Capabilities
Threat Coverage — MITRE ATT&CK
OBSIDIA detects and correlates threats mapped to the MITRE ATT&CK Enterprise framework. Includes native support for Latin American regulatory frameworks.
MITRE Tactic Detected Techniques Data Source Severity
Initial Access SSH/RDP Brute Force, public exploit OBSIDIA rule engine CRITICAL
Execution Shell commands, malicious scripts Integrity monitor HIGH
Persistence Crontab modification, services Integrity monitor (FIM) HIGH
Privilege Escalation sudo abuse, SUID/SGID Audit rules HIGH
Defense Evasion Log clearing, rootkits Rootkit detector MED
Credential Access Password spraying, hash dump Authentication logs CRITICAL
Lateral Movement PsExec, SSH tunnels Network rules HIGH
Impact Ransomware patterns, data deletion Behavior monitor CRITICAL
Compliance (SCA) CIS Benchmarks · PCI-DSS · LGPD · ISO 27001 · CNBV · INAI Compliance engine INFO
System Specifications
Traffic visibilityPer-minute aggregation · raw logs not stored
GeolocationLocal database · no third-party lookups
Log retention15 / 30 / 60 days by plan
Supported sourcesOpenSearch + SIEM/EDR adapters
AI AnalysisAI engine configurable per plan
Polling interval20s (configurable)
Batch size10 alerts / cycle
Event StorePostgreSQL · WAL mode
Admin StoreSQLite 3 · WAL mode
DashboardFastAPI + SSE (push real-time)
Automationn8n · 7 endpoints live
ContainersDocker Compose
NotificationsTelegram · Slack · Teams (road)
Operating systemsUbuntu 22.04 / 24.04 LTS
Minimum recommended RAM8 GB (full stack)
Minimum storage50 GB SSD
Supported ticket systemsosTicket · Jira · ServiceNow
07 · Plans & Licensing
Contracting options
All plans include the complete platform — detection, AI analysis, tickets, dashboard and basic n8n. The difference lies in the monitorable infrastructure capacity (FW, endpoints, WAF), the response SLA and advanced automation capabilities. Activation in less than 24 hours. No minimum commitment.
Starter
Quote / month
≤3 FW/routers ≤99 endpoints ≤1 WAF ≤1 O365 SLA 8h Retención 15d

  • Real-time detection 24/7
  • AI Analysis — Critical severity
  • Correlation with 5-alert threshold
  • Operational SOC dashboard
  • Automatic osTicket tickets
  • Weekly reports
  • n8n: SLA · agentes · spikes
  • Email support
Enterprise
Custom / year
Unlimited Unlimited FW SLA 2h Retención 60d

  • Everything in Pro plan
  • AI Analysis — fully configurable
  • Customizable correlation
  • Playbooks IA on-demand
  • Multi-level escalation chain
  • n8n: suite completa + roadmap
  • Monthly executive PDF reports
  • Multi-tenant / multi-site
  • Dedicated SOC analyst
  • Direct analyst support
Capacity included per plan
The primary discriminator is the number of firewalls/routers. Endpoints + servers are the complementary limit.
Type Starter Pro Enterprise
🛡️ Firewalls / routers≤ 34 – 10
💻 Endpoints + servers≤ 99100 – 999
🔒 WAF / databases≤ 1 eachIncluded
☁️ O365 tenants≤ 1Included
Available add-ons
+additional endpoints
Expands the endpoint limit within the same plan
Extended AI
Reduced correlation threshold and Medium+ analysis
Extended retention
+30 additional days of log and event retention
Executive PDF report
Custom monthly PDF report for management