Raptor Eye provides multi-tenancy through multiple flexible options. The brief architecture is plotted in the given figure
Raptor Eye provides multi-tenancy through multiple flexible options. The brief architecture is plotted in the given figure
The Raptor Eye manager node is the kind of node that analyzes the data received from all registered agents and triggers alerts when an event coincides with a rule. For example, intrusion detected, file modified, configuration not in accordance with the policy, possible rootkit, among others.
Agent based monitoring required an agent to be installed into the node e.g., server for monitoring whereas agentless doesn’t required any agent to be installed for monitoring.
RaptorEye Manager sends the data into a database which is Elasticsearch. Basically, it is a highly scalable kind of database. It allows you to store, search, and analyze big volumes of data quickly and in near real time. It is generally used as the underlying engine/technology that powers applications that have complex search features and requirements.
RaptorEye worker nodes are responsible for three main tasks:
A way to organize various dashboards and features into multiple workspaces to meet client-specific requirements.
Basically, a Master Node of Raptor Eye will be installed at the main site which can be some prime location of the organization or some cloud-based instance, but the workload of all agents will be managed on the client premises by configuring a worker node at the client side.
At client premises the following endpoints are expected:
Workstations
Laptops
Desktops
Email Servers
Database Servers
Application Servers
IP Cameras (log based)
Cloud Instances
Office 365 for Organization
All the logs from the above-mentioned endpoints will be collected by Raptor Eye agent and will be send out to worker node which is configured in client premises as discussed earlier. Now after this multiple worker nodes from multiple client environments will be synced to a primary master node and all the data will be ingested into database by the name of that client. All the data will be ingested in a common database, but each user will have a separate view of their data, this is just because of the isolated spaces which will be created at Raptor Eye user interface for multiple clients.
