Telecom Entities
The telecom domain, as evidence targets.
HAIEC models the telecom domain as typed entities with defined identity fields. Evidence, relations, and detections bind to these — so a finding about a cell site names the cell site.
17
entity types
RAN
Cell site
CellSite → node kind cell_site
Identity fields: siteId
Network cell
NetworkCell → node kind network_cell
Identity fields: cellId
Antenna sector
Sector → node kind sector
Identity fields: sectorId
Tracking area
TrackingArea → node kind tracking_area
Identity fields: tacId
User device
UE_Device → node kind ue_device
Identity fields: imsi, imei
User session
UE_Session → node kind ue_session
Identity fields: sessionId
Network slicing
Network slice
NetworkSlice → node kind network_slice
Identity fields: sliceId
Slice subnet
SliceSubnet → node kind slice_subnet
Identity fields: subnetId
Slice isolation policy
SliceIsolationPolicy → node kind slice_isolation_policy
Identity fields: policyId
Quality-of-service flow
QoS_Flow → node kind qos_flow
Identity fields: flowId
Core & service-based interface
Network function
NetworkFunction → node kind network_function
Identity fields: nfId
Core network call
SBI_Transaction → node kind sbi_transaction
Identity fields: transactionId
Function registration
NRF_Registration → node kind nrf_registration
Identity fields: nfId, registeredAt
Call route
SCP_Route → node kind scp_route
Identity fields: routeId
Call pattern baseline
NF_Communication_Pattern → node kind nf_communication_pattern
Identity fields: consumer, producer
Transport
Transport link
TransportLink → node kind transport_link
Identity fields: linkId
Data session
PacketSession → node kind packet_session
Identity fields: sessionId
Source of truth: lib/topology/telecom-entities.ts. Entity IDs are computed deterministically from identity fields — the same entity seen in two evidence sources resolves to the same node.