Jobs, Workflows & Detection#

Relata ships a unified extension + job + report framework — six extension kinds (Connector, Detector, Enricher, Scorer, Job, Report) sharing one signed Manifest, one ACL/principal/audit contract, and one scheduler plane. This page covers the detection/analysis surface: pattern-detection jobs, the detection-rules engine, governance-aware workflows, intelligence feeds, and the domain packs that bundle them.

Pattern detection#

Four typed continuous Job extensions run on a schedule, scan ingested data for investigation-significant patterns, and emit typed AlertEvent records with full PROV-O provenance. Each runs under the BATCH scheduler class (yields to interactive), writes alerts that inherit the strictest classification of the data that triggered them, and is validated by ExtensionShakedown against a GoldenDataset before promotion from shadow to live.

Jobs are discoverable via SUGGEST_EXTENSIONS() and surface in the MCP list_jobs / job_status / schedule_job tools. The detection algorithms live in crates/relata-jobs/src/pattern_detection/.

Detection rules engine#

A lightweight detection-rules engine complements the typed pattern-detection jobs. Rules are continuously evaluated against new data; each is defined in SQL or Sigma-compatible YAML.

# Register a detection rule (SQL condition against a target type)
curl -X POST http://localhost:9090/rules \
  -H "Authorization: Bearer $RELATA_BEARER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "large-transfer-flag",
    "trigger": {
      "type": "Transaction",
      "condition": "amount > 100000 AND currency = '\''USD'\''"
    },
    "action": "flag"
  }'

Sigma rule import#

Sigma is the vendor-neutral signature format for SIEM detection rules. Import Sigma YAML directly:

relata import-sigma rules/suspicious_dns.yaml

Rules must pass a precision/recall gate against a golden dataset before promotion from shadow to live.

Rule lifecycle#

Rule conditions are validated at create + eval time (rejects ;, --, /* */; rejects UNION/INTERSECT/EXCEPT adjacent to punctuation; 2048-byte length cap) to prevent SQL injection through rule text.

Detection modes#

• live — alerts fire immediately when data matches
• shadow — alerts are logged but not surfaced (for validation before promotion)
• disabled — rule is inactive

Workflows (governance-aware DAGs)#

Workflows are DAGs of steps that automate multi-stage analysis:

curl -X POST http://localhost:9090/workflows \
  -H "Authorization: Bearer $RELATA_BEARER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "fraud-investigation",
    "steps": [
      {"name": "detect", "type": "rule", "rule": "large-transfer-flag"},
      {"name": "enrich", "type": "lookup", "table": "sanctions_list"},
      {"name": "report", "type": "report", "template": "sars-template"}
    ]
  }'

Governance: every workflow step inherits the tenant context, PURPOSE, and ACL of the triggering request. Steps that would violate governance are blocked — workflows cannot bypass policy.

The crates behind it#

The MCP surface (job_status, list_jobs, schedule_job, list_workflows, run_workflow, workflow_status, list_rules, create_rule, import_sigma) mirrors these endpoints for tool-calling agents.

RIFN — Relata Intelligence Feed Network#

RIFN is Relata's signed, bi-temporal intelligence dissemination network: publishers push knowledge fragments to a Feed Broker over HTTPS + mTLS; the broker authenticates, re-signs the envelope, and exposes them as append-only, cursor-addressed channels; subscribers (a local Relata deployment) pull diffs and apply them to their ontology-graph via SmartIngest + EVIDENCE_INTAKE. Every feed entry is a typed, signed FeedEntry with 14 payload kinds covering the full ontological surface (object/link assertions, events, ontology extensions, enrichment rules, job definitions, governance policies, reference data, identity bindings, revocations…).

• The implementation lives in the relata-feed + relata-feed-broker crates.
• Subscribers ingest via a typed FeedSyncJob on a schedule — not a daemon — applying signed FeedEntry values through SmartIngest. Content-hash-addressed entries deduplicate across publishers automatically; RevokeEntry handles retractions first-class.
• The broker is the licensed component; the engine and subscriber-side FeedSyncJob are open core. A deployment may self-host a private broker for internal agency dissemination.
• Progressive bootstrap: a new subscriber consumes reference-data and ontology layers first (layers 0–3), then live intelligence (layers 4–7); subscribers track a high-water mark per channel.

Domain packs#

Packs bundle a domain's ontology types, detectors, jobs, reports, and detection rules into a signed, versioned unit. The repo ships ~20 domain packs + ~25 jurisdiction packs; the portal's use-cases map onto them:

relata-pack-stub demonstrates the pack layout for authoring new packs.

Jobs#

Background jobs (storage hygiene, correctness, retention/compliance, audit/integrity, performance, cluster, egress) run maintenance tasks:

relata jobs                  # list all jobs
relata jobs status indexer   # check a specific job

See also#

• Security — governance and policy enforcement
• Connectors & Extensions — the extension framework + Connector trait
• Observability — monitoring detection alerts
• Ingestion — ingest pipelines that feed detection