Sorry, but we don't really have any documentation on this yet. It's in the works and will be available relatively soon though.

Vocabularies are basically collections of typed metadata terms. Events may contain one or more values for any of those terms, and also are typed themselves (i.e. http-event versus page-event or session-event).

The Pion platform basically uses a bunch of plugins combined with XML configurations to manipulate streams of Events: Reactors, Codecs, Databases, Protocols, and (web) Services.

Events are generated using "collection" Reactors (LogInputReactor or SnifferReactor), may be fed through any number of "processing" Reactors (FilterReactor, TransformReactor, etc.), and saved using "storage" Reactors (LogOutputReactor, DatabaseOutputReactor, etc.). These data flow pipelines are controlled by the "ReactionEngine" and configured using the "Reactors" page of the web interface.

Codecs are used to serialize a stream of events (either writing or reading events) and are used by various Reactors such as LogInput/LogOutputReactor to know how to do that. Databases are used by various reactors to know how to communicate with various database engines/instances. Protocols are used by SnifferReactor to convert a stream of raw network traffic into a sequence of Events. Services are extensions to the web interface.

Atomic Labs publishes the Pion platform as well the API for developing any of these types of plugins in the Community Edition using an open source (GPL affero) license. We also sell maintenance services as well as an Enterprise Edition version of Pion that includes many additional (closed-source, commercial) plugins. If you're interested in learning more about our commercial offerings, please contact us using this form.

Also, sorry for the delayed reply. We only checks these forums periodically. You might want to subscribe to our Mailing Lists, as we normally respond much more quickly on those.