Skip to content

Suite Architecture

The three Perfware products are designed to share infrastructure. Log Processor owns the shared VPC and OpenSearch domain; AI Monitor and AI SIEM deploy onto that shared infrastructure as guests rather than standing up their own clusters. This keeps your AWS footprint — and cost — low, and it lets signals from all three correlate in one place.

Deploy order

Log Processor is the foundation and must be deployed first. AI Monitor and AI SIEM each take the Log Processor stack name at launch and deploy into its VPC and OpenSearch domain.

Log Processor      (owns VPC + OpenSearch)   ← deploy first
   ├── AI Monitor  (guest: metrics)
   └── AI SIEM     (guest: security events)

How the signals reinforce each other

  • Log Processor ingests application and service logs and runs pattern detection on them.
  • AI Monitor watches CloudWatch metrics and detects anomalies against learned baselines.
  • AI SIEM correlates AWS security signals (CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, Config) into threat timelines — and reads the anomalies the other two record from the shared OpenSearch domain, folding application-layer and metric signals into the same security timeline.

Each product works standalone. Together they cover the full kill chain — application, infrastructure, and network — without any data leaving your account.