Core Architectural Layers
1. Physical & Virtual Infrastructure Layer
The platform is built atop high-availability clusters using hybrid processing nodes and redundant storage (SAN + vSAN) and redundant networking + security devices. All virtual environments are segmented via VLANs, virtual firewalls (VDOMs), virtual switches (vSwitches) to isolate tenants and services. All communication is done over TLS based on client/server certificate authentication (RSA 2048/4096 with SHA256 ).
2. Logical Environments:
Tenant SOCaaS Pods: Isolated environments simulating real-world SIEM and SOCs for SMEs and public bodies.
Shared Services Platform: Hosts Central CTI, MISP, Corelation engine and vulnerability scanners used across all tenants.
Research & Training POD: An anonymized data lake and research portal for threat pattern analysis and cyber range simulations.
3. Threat Intelligence & Analytics Layer
OpenCTI (v6.0.5), MISP, and Cortex instances provide structured CTI ingestion, analysis, and enrichment.
REST API connectors feed data from 10+ sources (AlienVault, MITRE, AnyRun, etc.).
SOC dashboards visualize confidence scoring, indicators, and incident response metrics.
4. Access & Orchestration Layer
DNS, LDAP, PAM, and NTP services manage authentication and orchestration.
Web-based access via a secured portal using TLS 4096-bit certificates.
Management VLANs isolate administrative services from data and user planes.
