Zeek SOC AI Detection Pipeline on AWS integrates on-premise Zeek sensors with a multi-AZ AWS infrastructure for real-time network threat detection and machine learning-driven analysis. Traffic flows from Zeek sensors through WAF and ALB to backend EC2 instances, which queue detection tasks to AI Worker instances for model inference against logs and evidence stored in S3. RDS PostgreSQL with cross-AZ replication, ElastiCache for performance, and comprehensive monitoring via CloudWatch, GuardDuty, and Security Hub provide high availability, data durability, and security visibility. This architecture demonstrates defense-in-depth with encryption via KMS, secrets management, and automated alerting to SOC analysts. Fork and customize this diagram on Diagrams.so to adapt subnet ranges, instance types, or add additional detection layers.