dfe-engine

Every page in the dfe-engine section.

• DFE architecture
• Data evolution
• The DFE Control-Plane Layer
  • OIDC + RBAC architecture and design
  • RBAC - the engine's own reads
  • RBAC - IdP group sync and links
  • RBAC - identity resolution and first login
  • RBAC vocabulary - roles, groups and terms
  • RBAC, Multi-Tenant ClickHouse, and Auth Architecture
  • Synthetic Data
  • Identity provider setup
    • Microsoft Entra ID sign-in for DFE
    • Google Workspace sign-in for DFE
    • Okta sign-in for DFE
• Data plane
  • DFE Expression Language — CEL
  • Field mapping layer
  • Hunt-runner scaling: deterministic-due, no engine dependency
  • Hunt schedule smoothing - flattening CH load by phase drift
  • DFE Query API - Python SDK
  • DFE Query API - Rust SDK
  • DFE Query API - TypeScript SDK
  • DFE Query API
  • Schema bootstrap -- the engine is the only controller
  • Schema Type System v2
  • Sigma detection pipeline
  • The source definition
  • Detections on a source
  • The source flow - one definition, two transports
  • Storing and operating a source
  • What a source compiles into
  • Source - the top-level data abstraction
  • The topic contract
• Deployment seam
  • DFE Backing Services - swap every backend at a seam
  • KEDA scaling patterns
  • DFE Observability Standard
  • Transports and profiles