> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/installation-and-configuration/architecture.md). # Architecture The following architecture diagram shows the structure of a complete Enginsight on-premises deployment, including all core components, optional extensions, and the associated network communication paths.
*** ### Central Enginsight Servers The core server components of an Enginsight on-premises deployment are the **Enginsight Application Server** and the **Enginsight Database Server**. #### Application Server The **Application Server** hosts the Enginsight platform user interface, API, and all Enginsight services. It serves as the central communication hub for all Enginsight components and is accessible via **port 443** by default for: * The user interface of the **Enginsight Platform** via browser access. * One or more **Enginsight Component Servers** running the **Hacktor**, **Watchdog**, and **Observer** components. * The **Enginsight agent Pulsar**, which can be installed on Windows, Linux, and macOS systems. When the Enginsight SIEM is in use, Pulsars also act as log collectors. * The **SIEM Management Server**, if the Enginsight SIEM is in use. For data storage, the Application Server connects to the Database Server via **port 27017**. To retrieve platform, component, and service updates, as well as the latest CVEs, APT intelligence, and other threat data, the Application Server connects to the **Enginsight Update Server** over the internet via **port 443**. #### Database Server The **Database Server** serves as the central storage location for all Enginsight platform data except SIEM log data. It uses **MongoDB**, a document-oriented NoSQL database management system. The Application Server is the only server component that communicates directly with the Database Server, using **port 27017**. *** ### Component Server and Pulsar The **Hacktor**, **Watchdog**, and **Observer** components installed on a **Component Server**, as well as the **Pulsar**, are primarily responsible for collecting data from and monitoring hosts (servers and clients) and endpoints (websites and domains). #### Component Server One or more **Enginsight Component Servers** can be used to operate the following components: * **Hacktor** is an Enginsight component deployed as a service within a specific network segment. It performs penetration tests against reachable assets based on a defined set of security checks. * **Watchdog** is an Enginsight component deployed as a service within a subnet. It is used to monitor network devices that cannot run a Pulsar and to inventory systems without requiring an installed agent. * **Observer** is an Enginsight component deployed as a service on servers in different (geographic) locations. It monitors endpoints (websites and domains). While all three components can run on the same server, a dedicated deployment for each component is recommended. Component Servers communicate with the Application Server via **port 443** by default. They can be deployed either within the same network as the Enginsight on-premises installation or in a separate customer environment. #### Pulsar **Pulsar** is an agent installed on Windows, Linux, or macOS hosts (servers or clients). It monitors hosts internally and enables the detection and prevention of network-based attacks. Within the Enginsight SIEM architecture, Pulsars additionally function as collectors for raw log data, which is then forwarded to the SIEM. Pulsars communicate with the Application Server via **port 443** by default, regardless of whether they are deployed within the same network as the Enginsight installation or in a remote customer environment. *** ### Central SIEM Servers The **Enginsight SIEM (Security Information and Event Management)** can optionally be deployed alongside an Enginsight on-premises installation. It collects security information from internal and external log sources, analyzes incoming log data, and makes the results available for further processing. The central SIEM infrastructure consists of the **SIEM Management Server** and the **SIEM Index Server**. #### SIEM Management Server The **SIEM Management Server** uses **Apache ZooKeeper** and hosts the **Enginsight Loggernaut**, the central control component of the SIEM. It acts as the central communication hub for all SIEM components and is accessible via the following ports: * **Port 443** for communication with the Enginsight API on the Application Server. * **Port 2181** for communication with the SIEM Index Server. * Optional: **port 443** for the Enginsight **Tracer** component. * Optional: **port 443** when using an external S3-compatible backup server. * Optional: **port 22** when using an external SFTP backup server. #### SIEM Index Server The **SIEM Index Server** uses **Apache Solr** and serves as the primary database for the Enginsight SIEM. It indexes log data and makes it easily searchable. The SIEM Management Server communicates with the SIEM Index Server via **port 8983**. Multiple SIEM Index Servers can be operated in parallel. These servers also communicate with each other via **port 8983**. *** ### Tracer (Optional) **Tracer** is an Enginsight component responsible for Machine Learning-based time-series analysis within the Enginsight SIEM and, in other contexts, on monitored hosts. Tracer can run on the SIEM Management Server, although a dedicated deployment is recommended. When deployed on a separate server, Tracer communicates with the SIEM Management Server via **port 443**. *** ### External Backup Server (Optional) The **Loggernaut** SIEM component supports two backup strategies for automatically storing raw log data outside the local storage of the SIEM Management Server: * **S3-compatible backup server**: Raw logs are stored on an Amazon S3-compatible backup server in addition to local storage. Communication between the SIEM Management Server and the backup server takes place via **port 443**. * **SFTP backup server**: Raw logs are stored on an SFTP (Secure File Transfer Protocol) server in addition to local storage. Communication between the SIEM Management Server and the backup server takes place via **port 22**. *** ### Customer Networks (Example) Every Enginsight on-premises deployment is linked to a **main organization**. Any number of **suborganizations** can be created under the main organization, each with its own dedicated Enginsight user interface. A suborganization may represent, for example, a customer and its network environment. All customer environments operate independently and cannot access each other's data. Only the main organization, which operates the Enginsight Application Server and Database Server, has visibility across all suborganizations. Within each customer environment, dedicated **Component Servers** can be deployed to run the Hacktor, Watchdog, and Observer components, and **Pulsars** can be installed on hosts. Both Component Servers and Pulsars forward their data to the central Application Server of the main organization via **port 443**. ***