Architecture

OpenSourceOM is designed as modular, cloud-native components you can run on Kubernetes or Docker Compose.

Components

• Collectors — pull inventory, IAM, network, and vulnerability data from cloud APIs
• Normalizer — map provider-specific resources into a unified graph schema
• Graph store — persist nodes/edges and run path queries (Planned: open graph DB backend)
• Rules engine — CSPM policies and custom detections tied to graph context
• API & UI — GraphQL/REST API and web console for exploration and remediation

Data flow

Cloud APIs → Collectors → Normalizer → Graph Store → API/UI
                              ↘ Rules Engine → Findings (with path context)

Deployment options

• Pilot — single-node Docker Compose
• Production — Kubernetes with HA graph store and horizontal collectors
• Air-gapped — offline vulnerability feeds and private registry mirrors

Extensibility

Connectors are plugins. Community adapters for Kubernetes, GitHub, and SIEM exports live alongside core cloud providers. See the core repository for SDK details (coming soon).