SAGA Architecture
One scenario connects the environment, the exercise, and the evidence.
SAGA’s architecture supports a repeatable learning loop. Infrastructure gives the scenario a place to run; telemetry gives the defender a view; validation connects what was intended with what happened. This overview describes those responsibilities without representing live inventory or deployment status.
Start with the logical topology
The logical topology follows the relationship between scenario intent, exercise control, the exercise world, observations, and the debrief. It explains what each role contributes and how the evidence flows between them.
Design responsibilities
Build the environment.
Versioned machines, identity services, and application targets provide a controlled setting for an exercise. Rebuild and reset are part of the design.
Make behaviour observable.
Endpoint, network, identity, and application observations support investigation. Telemetry expectations belong with the scenario rather than being added after the exercise.
Keep automation reviewable.
Tools and agent workflows work from explicit inputs and boundaries. Live actions remain subject to scope and operator approval.
Carry knowledge forward.
Evidence, analyst decisions, and lessons feed the next exercise. Public summaries pass through a separate review and publication boundary.
The learning loop
Define the scenario, build its environment, validate the intended paths, run the exercise, compare observations with ground truth, then reset and refine. The SAGA overview explains each stage.
Public by design
The public site explains system shape and engineering intent. Private inventory, credentials, operational commands, and raw evidence stay outside this publication boundary.