Manager Node (Master)

The Raptor Eye manager node is the kind of node that analyzes the data received from all registered agents and triggers alerts when an event coincides with a rule. For example, intrusion detected, file modified, configuration not in accordance with the policy, possible rootkit, among others.

Agentless vs Agent Based Monitoring

Agent based monitoring required an agent to be installed into the node e.g., server for monitoring whereas agentless doesn't required any agent to be installed for monitoring.

Database Node

Raptor Eye Manager sends the data in to database which is Elasticsearch. Basically, it is a highly scalable kind of database. It allows you to store, search, and analyze big volumes of data quickly and in near real time. It is generally used as the underlying engine/technology that powers applications that have complex search features and requirements

Worker Node (Slave)

Raptor Eye worker nodes are responsible for three main tasks

1. Synchronizing integrity files from the master node.
2. Sending agent status updates to the master.
3. Redirecting agent registration requests to the master.

Meet Raptor Eye spaces - a way to organize various dashboards and features into multiple workspaces to meet client specific requirements.

Basically, a Master Node of Raptor Eye will be installed at the main site which can be some prime location of organization or some cloud-based instance, but the workload of all agents will be managed the client premises by configuring a worker node at the client side.

At client premises the following endpoints are expected.

• Workstations
• Laptops
• Desktops
• Email Servers
• Database Servers
• Application Servers
• IP Cameras (log based)
• Cloud Instances
• Office 365 for Organization

All the logs from the above-mentioned endpoints will be collected by Raptor Eye agent and will be send out to worker node which is configured in client premises as discussed earlier. Now after this multiple worker nodes from multiple client environments will be synced to a primary master node and all the data will be ingested into database by the name of that client. All the data will be ingested in a common database, but each user will have a separate view of their data, this is just because of the isolated spaces which will be created at Raptor Eye user interface for multiple clients.

The above figure describes us the concept of multi-tenant environment in a nutshell and the same concept would be used in our Raptor Eye SIEM