Deployment Architecture Overview
Dinesh
Last Update 2 months ago
Overview
SecOps Solution On-Premises is designed to be deployed entirely within the customer's environment, providing centralized Vulnerability Management, Patch Management, and Configuration Audit capabilities while maintaining full control over infrastructure, data, and network communication.
The platform provides centralized vulnerability management, patch management, compliance monitoring, and asset visibility while allowing organizations to adopt the deployment model best suited to their network architecture and security requirements.
SecOps Central Server
The SecOps Central Server is the primary management component of the platform and serves as the central point for all security and patch management operations.
The Central Server hosts the application services, platform database, and local patch repository cache required for daily operations.
Asset Management Architectures
SecOps Solution supports multiple deployment models, allowing organizations to manage assets across different network architectures and operational environments.
Direct Agentless Deployment
In the Agentless deployment model, the SecOps Central Server communicates directly with managed assets using standard administrative protocols such as WinRM and SSH.
This deployment method is ideal when:
This deployment method is ideal when:
- Assets are directly reachable from the Central Server
- Administrative credentials are available
- Network segmentation is minimal
- No endpoint software installation is preferred
Benefits:
- No agent installation required
- Simplified management
- Faster onboarding for internal assets
Agent-Based Deployment
In the Agent-Based model, lightweight agents installed on endpoints establish outbound communication with the SecOps Central Server.
This deployment method is recommended for:
This deployment method is recommended for:
- Remote assets
- Dynamic IP environments
- Assets with limited inbound accessibility
Benefits:
- Simplified connectivity
- Improved management of remote asset
- No inbound firewall rules required
- Continuous visibility of endpoint status
Relay Server Deployment
The Relay Server deployment model is designed for environments where managed assets are located in isolated networks, restricted segments, branch offices, or environments where direct communication with the SecOps Central Server is not possible.
A Relay Server acts as an intermediary between the SecOps Central Server and managed assets, enabling centralized management while maintaining network segmentation and security requirements.
Relay Servers can operate in either Jump Host Mode or Distribution Server Mode depending on the organization's requirements.
Jump Host Mode
In Jump Host Mode, the Relay Server is used solely to provide connectivity between the SecOps Central Server and assets located within isolated network segments.
All management activities, including vulnerability assessments, configuration audits, and patch deployments, are routed through the Jump Host.
This deployment model is commonly used for:
- Segmented VLANs
- Secure server networks
- Restricted environments
- Remote data centers
Benefits
- Maintains network segmentation
- Reduces firewall complexity
- Enables centralized management of isolated assets
- Supports agentless operations across restricted networks
Distribution Server Mode
In Distribution Server Mode, the Relay Server provides both connectivity and local patch distribution capabilities.
In addition to routing communication between the SecOps Central Server and managed assets, the Distribution Server maintains a local cache of patch content. Assets within the network segment can retrieve required patches directly from the Distribution Server rather than downloading them from the Central Server.
This deployment model is commonly used for:
- Branch offices
- Remote locations
- Bandwidth-constrained environments
- Large distributed networks
Benefits
- Provides centralized connectivity and management
- Reduces WAN bandwidth consumption
- Minimizes repeated patch downloads
- Accelerates patch deployment across remote sites
- Improves deployment reliability in low-bandwidth environments
Content Synchronization Workflows
Internet-Connected Central Server
In environments where the SecOps Central Server has internet connectivity, vulnerability intelligence, patch metadata, and required patch binaries are synchronized directly from SecOps cloud and vendor sources.
This deployment model provides:
- Automatic vulnerability database updates
- Automatic patch catalog updates
- Direct patch downloads
- Simplified maintenance
Air-Gapped Central Server
For highly restricted environments where the SecOps Central Server does not have internet connectivity, SecOps supports offline content synchronization.
A separate internet-connected workstation can be used to download:
- Vulnerability database updates
- Security intelligence
- Patch metadata
- Patch binaries
The downloaded content can then be transferred to the SecOps Central Server through approved methods such as:
- USB Media
- Secure File Transfer
Benefits:
- Supports fully isolated environments
- Eliminates direct internet dependency
- Maintains current vulnerability intelligence
- Enables secure content updates
Linux Patch Distribution in Restricted Environments
In some environments, Linux servers are not permitted to access public package repositories directly.
To support these environments, organizations may maintain internal Linux repositories that synchronize approved packages from vendor repositories.
Linux systems are configured to retrieve required packages from the internal repository. During patch deployment, SecOps identifies the required updates, initiates the deployment process, and installs the necessary packages from the configured repository source.
This approach is commonly used in:
- Air-gapped environments
- Highly restricted networks
- Compliance-driven infrastructures
For detailed implementation guidance, refer to the Linux Local Repository Configuration Guide.