TIDIROpen SecOps Reference Architecture

1. The Architecture at a Glance ​

TIDIR governs the operational progression from raw environmental observation to automated mitigation within a strict closed loop:

The closed loop is completed as operational outcomes and incident graph nodes from Actuation (4) enter Continuous Calibration (5), which continuously re-keys threat caches, converts theoretical exposure into realized risk in CTEM platforms, and issues automated hardening pull requests back into the Telemetry Data Plane (1).

2. Choose Your Lens: Role-Based Fast-Tracks

TIDIR addresses executive strategy, operational engineering, and formal system safety simultaneously. Select your primary lens to navigate straight to the specifications that matter to you (or explore the complete Role-Based Persona Journeys):

3. Why TIDIR Exists: The Asymmetric Deficit in SecOps ​

Modern security operations struggle with three basic problems:

1. The Ingestion Dilemma (We discard what we might need tomorrow): Traditional security monitoring tools charge by data volume. To manage costs, engineering teams discard high-volume logs at the network edge. Months later, when a new vulnerability is discovered, the historical records needed to investigate are gone.
2. Low Base Rates & Alert Amplification (High accuracy still produces alert fatigue): In an enterprise generating a billion events each day, an analytical rule with 99.9% accuracy still creates thousands of false alarms because malicious events are exceedingly rare. Correlated alerts amplify this volume, causing analyst overload and degraded triage quality.
3. The Unchecked Automation Hazard (Automated fixes can break production or reopen doors): Traditional response scripts either crash mid-execution or attempt database-style rollbacks that accidentally restore network access for an active attacker. Meanwhile, connecting generative AI directly to operational tools allows prompt injection attacks to trigger unauthorized actions.

TIDIR addresses these problems by separating the architecture into four distinct planes—isolating untrusted data and advisory AI models within an open analytical environment, while protecting critical systems behind a lean, deterministic defence control plane.

4. The Core Architectural Thesis ​

TIDIR is built on seven core ideas. Each idea pairs an intuitive rule with a technical safety mechanism:

5. What TIDIR Is (and Is NOT) Claiming ​

To maintain engineering clarity, TIDIR explicitly distinguishes between established industry patterns and its own architectural contributions:

TIDIR's contribution is the specific architectural synthesis and governing safety invariants under which these established techniques interact.

By wrapping untrusted telemetry and probabilistic AI agents within deterministic policy gates and monotonic state machines, TIDIR enables modern security operations to automate investigations and containment safely—while reducing the risk of runaway automation, self-granting authority, and loss of defensive visibility.

For detailed definitions of established, adapted, and TIDIR-specific concepts, explore the Architectural Glossary & Concept Taxonomy.

6. The 3-Tier Architectural Model ​

To serve executive leaders, enterprise architects, and engineering practitioners simultaneously, TIDIR organizes its specifications across three increasing levels of technical specificity:

• Tier 1: Strategic Architecture: System topology, the 11 constitutional invariants, and the formal threat model. Target audience: CISOs, Heads of SecOps, Lead Enterprise Architects.
• Tier 2: Capabilities & Taxonomy: Functional capability taxonomy, enterprise service catalogue, and operational user stories. Target audience: Security Managers, Detection Leads, SecOps SREs.
• Tier 3: Technical Specifications: Concrete data schemas (OCSF), workload identity contracts (SPIFFE), monotonic state machines, and the ADR Registry. Target audience: Detection Engineers, Automation Engineers, SecOps Architects.

7. Open Security Frameworks Alignment ​

TIDIR synthesizes defensive strategy, analytic taxonomy, API safety, and operational controls into a unified multi-framework alignment:

• Adversary Tactics & Attack Patterns: MITRE ATT&CK (Enterprise TTPs), MITRE ATLAS (AI/ML Threats), MITRE CAPEC (Attack Patterns).
• Defensive Countermeasures & Analytics: MITRE D3FEND (Defensive Techniques), D3FEND ACF (Analytic Characterization Framework), MITRE CAR (Cyber Analytics Repository).
• Active Defense & Deception Operations: MITRE ENGAGE (Expose, Affect, Elicit, Understand).
• AI & API Tool Safety: OWASP Top 10 for LLMs (Prompt Injection & Agency), OWASP API Security Top 10 (BOLA, Broken Auth, Tool Boundaries).
• Enterprise Assurance & Data Schemas: CIS Controls v8 (Controls 5, 6, 8, 13, 17), OCSF (Open Cybersecurity Schema Framework), STIX 2.1 / TAXII.

8. Open Source & Machine Access ​

TIDIR is published as an open-source reference standard under the Apache 2.0 License:

• 💻 GitHub Repository: github.com/Haribu/TIDIR
• 📡 Machine-Readable Graph: /architecture.json
• 🤖 AI / LLM Ingestion Summary: /llms.txt
• 📚 Complete Single-File Corpus: /llms-full.txt
• 🗺️ Sitemap: /sitemap.xml