Tripwire infrastructure
From a declarative detector to an observable workload and a reviewed finding.
How to read this architecture
Each Detector resource owns a workload, durable consumer, state volume and generated observability. All detectors share the NATS transaction stream and process it independently. Advisory and active detectors publish findings; shadow detectors withhold them.
The analyst service reads published findings and saves assessments in a separate append-only review stream. The manager page separates analyst-reviewed quality from a labelled synthetic algorithm benchmark. Prometheus and Grafana show workload health.
NATS has one replica; its volume holds transactions, alerts and reviews. The analyst service is reached over HTTPS ingress, with a demo identity and no role-based access control. Tripwire does not use Neo4j.