AZ-01 Azazel-Edge - Deterministic Edge SOC/NOC Gateway
Codename: SENTINEL
Azazel-Edge is the AZ-01 core platform of the Azazel system, a Raspberry Pi-oriented deterministic edge SOC/NOC gateway and Cyber Scapegoat Gateway for constrained, temporary, and high-risk networks.
It observes local network evidence (Suricata EVE), and the Rust defense core (azazel-edge-core) decides a bounded action from it and, only when enforcement is explicitly enabled, applies it. Operator-visible explanations and audit traces are recorded for each decision.
Optional local AI assist runs after the deterministic decision. It may summarize or explain the result, but it does not decide or enforce anything.
Azazel-Edge is not a production SIEM replacement, not an autonomous AI defender, and not a promise of complete attack prevention.
For safe checkout checks, see Development Verification. The device installer below changes system, network, storage, and optional model-runtime state.
Who this is for: security operators, field defenders, incident responders, training teams, and researchers working with constrained local networks.
2025 -> 2026 evolution line:
Deployable focus (rapid portable edge setup) -> Auditable focus (explainable deterministic decisions, rejected alternatives, and reviewable trace evidence)
Responsibility Split
| Component | Role today |
|---|
Rust core (rust/azazel-edge-core, azazel-edge-core.service) | The live decision and enforcement path. It reads Suricata EVE, selects the action (decide_defense()), and applies it only when enforcement is enabled (maybe_enforce()). It releases leases on expiry. |
Python ActionArbiter (py/azazel_edge/arbiter/) | A deterministic decision record for scenario replay, benchmarks and the SOC policy dry run. No running service applies its output. |
AI agent (azazel-edge-ai-agent.service, py/azazel_edge_ai/) | Receives each event after the core has decided. It records the decision, computes the tactical score and second-pass SOC evaluation, and writes advisory text. It cannot change the action. |
Shared M.I.O. package (azazel_mio) | If installed, the AI agent uses the pinned shared AssistantCore without a model for bounded post-decision advisory analysis. The current immutable source pin is commit a1807bf7abb08788b834ae038f7a8b46d09d0acc (package version 0.1.0.dev20261106+gitbb6dcfd), not a public MIO release. Edge retains this pin independently of the newer Nexus runtime candidate and the separate IR candidate. Its output cannot change Edge's action. |
Edge-local M.I.O. modules (py/azazel_edge/mio/) | Shadow, replay, and evaluation tools only; no systemd unit starts these local modules. They are distinct from the shared azazel_mio package. Their recommendations are never executable. |
| Control daemon and Web UI | Display, operator controls and fixed control actions. The core never reads their state. |
Automatic actions can observe, notify and apply temporary flow-scoped throttling. Redirection to a prepared decoy is allowed in semi-auto only when high-impact automation is enabled, and in full-auto. isolate is not an automatic action.
The live agent submits the shared no-model M.I.O. advisory by default when the package is importable. AZAZEL_MIO_MODEL_ENABLED=1 separately enables the local-model lane; it is disabled by default. The separate Knowledge Context lane also requires AZAZEL_MIO_KNOWLEDGE_CONTEXT_ENABLED=1 and is disabled by default. A package pin or producer-capture fixture does not establish end-to-end Knowledge producer interoperability.
Full authority matrix: M.I.O. Cognitive Plane.
Requirements
| Requirement | Detail |
|---|
| Hardware | Raspberry Pi-oriented; tested/developed for constrained edge deployment |
| OS | Raspberry Pi OS / Linux |
| Runtime | Python 3.11 or later (CI tests 3.11; Raspberry Pi OS trixie, the device target, ships 3.13), Rust core components |
| Network | Local edge segment with optional Suricata/OpenCanary integration |
| Optional | Ollama (local AI model runtime), Mattermost, Wazuh, Vector, Aggregator |
Shipped Defaults
The values below are the shipped systemd unit-file values declared with Environment= in systemd/azazel-edge-core.service. The unit also loads /etc/default/azazel-edge-security through EnvironmentFile=, and settings from that file override the unit's Environment= values on a device. The effective values on a given device can therefore differ from this table. Verify dry-run behavior with the Hardware First-Run Checklist.
The table is not exhaustive; the unit declares other variables as well.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
