<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 675" width="1200" height="675" role="img" aria-label="Falco 运行时安全信号与告警链路">
  <rect width="1200" height="675" fill="#0f172a"/>
  <defs><marker id="af" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto"><path d="M0 0 L10 5 L0 10 Z" fill="#38bdf8"/></marker></defs>
  <text x="105" y="80" font-family="Arial, sans-serif" font-size="28" font-weight="700" fill="#f8fafc">运行时事件到安全告警</text>
  <text x="105" y="112" font-family="Arial, sans-serif" font-size="18" fill="#cbd5e1">系统调用与 Kubernetes 元数据驱动分级响应</text>

  <g font-family="Arial, sans-serif">
    <rect x="105" y="190" width="180" height="110" rx="18" fill="#1e293b" stroke="#38bdf8" stroke-width="2"/>
    <text x="170" y="232" text-anchor="middle" font-size="20" font-weight="700" fill="#e0f2fe">运行时信号</text>
    <text x="170" y="264" text-anchor="middle" font-size="16" fill="#cbd5e1">进程 / 文件</text>
    <text x="170" y="288" text-anchor="middle" font-size="16" fill="#cbd5e1">网络 / 容器</text>

    <rect x="330" y="190" width="180" height="110" rx="18" fill="#1e293b" stroke="#a78bfa" stroke-width="2"/>
    <text x="420" y="232" text-anchor="middle" font-size="20" font-weight="700" fill="#ede9fe">规则匹配</text>
    <text x="420" y="264" text-anchor="middle" font-size="16" fill="#cbd5e1">宏 / 列表</text>
    <text x="420" y="288" text-anchor="middle" font-size="16" fill="#cbd5e1">条件组合</text>

    <rect x="580" y="190" width="180" height="110" rx="18" fill="#1e293b" stroke="#fbbf24" stroke-width="2"/>
    <text x="670" y="232" text-anchor="middle" font-size="20" font-weight="700" fill="#fef3c7">上下文补齐</text>
    <text x="670" y="264" text-anchor="middle" font-size="16" fill="#cbd5e1">命名空间 / Pod</text>
    <text x="670" y="288" text-anchor="middle" font-size="16" fill="#cbd5e1">服务账户 / 镜像</text>

    <rect x="830" y="190" width="180" height="110" rx="18" fill="#1e293b" stroke="#fb7185" stroke-width="2"/>
    <text x="920" y="232" text-anchor="middle" font-size="20" font-weight="700" fill="#ffe4e6">告警输出</text>
    <text x="920" y="264" text-anchor="middle" font-size="16" fill="#cbd5e1">日志 / HTTP</text>
    <text x="920" y="288" text-anchor="middle" font-size="16" fill="#cbd5e1">告警平台</text>

    <path d="M260 245 H328" stroke="#38bdf8" stroke-width="3" marker-end="url(#af)"/>
    <path d="M510 245 H578" stroke="#38bdf8" stroke-width="3" marker-end="url(#af)"/>
    <path d="M760 245 H828" stroke="#38bdf8" stroke-width="3" marker-end="url(#af)"/>

    <rect x="170" y="415" width="210" height="92" rx="18" fill="#172554" stroke="#60a5fa" stroke-width="2"/>
    <text x="275" y="452" text-anchor="middle" font-size="19" font-weight="700" fill="#dbeafe">高置信规则</text>
    <text x="275" y="480" text-anchor="middle" font-size="15" fill="#cbd5e1">异常 shell / 敏感路径</text>
    <rect x="495" y="415" width="210" height="92" rx="18" fill="#422006" stroke="#f59e0b" stroke-width="2"/>
    <text x="600" y="452" text-anchor="middle" font-size="19" font-weight="700" fill="#fef3c7">噪声治理</text>
    <text x="600" y="480" text-anchor="middle" font-size="15" fill="#cbd5e1">精确例外 / 观察</text>
    <rect x="820" y="415" width="210" height="92" rx="18" fill="#450a0a" stroke="#f87171" stroke-width="2"/>
    <text x="925" y="452" text-anchor="middle" font-size="19" font-weight="700" fill="#fee2e2">响应闭环</text>
    <text x="925" y="480" text-anchor="middle" font-size="15" fill="#cbd5e1">确认 / 隔离 / 复盘</text>
  </g>
</svg>
