How to read this
The diagram reads left to right. Dots on the left are raw data sources, grouped into bands by the common schema they map to (ASIM for security, HL7 FHIR for healthcare); a few real source names label each band. The middle column is the normalization layer: one schema per band. On the right are the consumers: the upper grid is the rule fleet (navy dots) and the lower grid is the agent fleet (blue dots). The domain buttons switch the same diagram between a security operations example and a healthcare example. Moving dots are events.
With Normalized selected, each source feeds one parser into its schema, and every consumer reads only the schema. With Not normalized selected, every consumer reads raw sources directly, so each one needs a line to every source in its band; the drawing shows a sample of those lines, and the table below gives the full counts. The rules and agents sliders set the size of each fleet; with "Same count for rules and agents" ticked they move together, so the two designs compare like for like. The agent fleet is split into specialist groups, each reading the schemas its job needs; incidents from the rule fleet start an orchestrator, and every action an agent proposes goes to the enforcer on the right. Together these three roles replace a SOAR playbook. Amber dots are consumers interpreting a raw format. Red dots are consumers broken by a schema change at a source. The table always shows both designs, with the selected one highlighted.
Architecture draws the same example as Microsoft services, left to right. Raw sources feed the normalized data store (the lime-outlined cylinder, the layer the fleet diagram is about). The rule fleet reads it directly; agents reach it only through the tool layer. The agent runtime shows the orchestrator and the specialist types it starts; the bracket marks the orchestrator, specialists and enforcer as the replacement for a SOAR playbook. Animated blue lines are data flow, the dashed navy line is incidents raised by rules that start agent work, and the grey dashed line is agent activity written back as a log source. Proposed actions pass through the enforcer before anything runs. The two bands at the bottom, identity and observability, apply to every layer. Click any part of the diagram to open its detail, including the SIEM skill that applies, in the list below it.
| Question |
|---|