Federated Cyber Situational Awareness
Local autonomy for every site or department, centralised strategic visibility and security status read on the infrastructure maps.
Every site operates autonomously
Sentinet³ supports a federated multi-instance architecture, designed for complex organisations that are geographically distributed or structured into departments and offices, and that need both local autonomy and centralised strategic visibility.
Each office, site or department works with its own independent instance. Each local instance:
- autonomously manages devices, thresholds, alerts, dashboards, users and maps;
- keeps its data locally, on-premise;
- restricts visibility to the authorised perimeter only.
Connected instances, tailored data sharing
Instances federate with each other: each one connects securely to one or more central or regional instances and shares data and events selectively, according to granular policies.
Information is synchronised in pull (on-demand) or push (event-driven) mode, configurable according to the operational context. Federation can be hierarchical or peer-to-peer and is always encrypted, authenticated and traced.
| Aspect | How it works in Sentinet³ |
|---|---|
| Connection | Secure connection of each instance to one or more central or regional instances. |
| Sharing | Selective sharing of data and events through granular policies. |
| Synchronisation | Pull (on-demand) or push (event-driven), chosen according to the operational context. |
| Topology | Hierarchical or peer-to-peer federation. |
| Protection | Encrypted, authenticated and traced communications. |
At the top of the federation, a single console
The centralised console is designed for IT management, unified SOCs and internal governance or supervisory bodies. It brings together what each local instance has chosen to share and makes it readable as a single picture.
- Aggregates and displays data, KPIs, maps and alerts from the local instances.
- Shows only the data previously authorised by each federated instance.
- Provides comparative analysis and cross-domain correlation tools.
- Offers aggregated dashboards and multi-level maps reflecting the distributed state of the infrastructure.
Each instance decides what to share
All data displayed in the centralised console is subject to an explicit authorisation policy, defined locally by each federated instance, in line with the principles of confidentiality, functional segregation and data protection.
Permissions to view, query and interact with federated data are managed through:
- access control lists (ACLs);
- centralised or federated user profiles;
- a complete audit log of the operations performed through the centralised console.
Integration with security systems
Sentinet³ provides an integrated, real-time and contextualised view of the security status of the IT infrastructure, supporting operational and strategic decisions in highly critical contexts.
The platform interfaces with the main security tools through standard APIs or native connectors, in order to:
- collect security events in real time;
- correlate events with the topology and architecture of the infrastructure;
- display aggregated data in the multi-level and tactical maps.
| Integrated system | Description |
|---|---|
| SIEM | Security Information and Event Management. |
| EDR/XDR | Endpoint and Extended Detection and Response. |
| DDoS mitigation | Systems that mitigate DDoS attacks. |
| Next-generation firewalls | NGFWs protecting the infrastructure. |
| AD, LDAP, IAM | Authentication and access control systems. |
Elements under attack, on the map
Cyber Situational Awareness maps graphically represent the operational and security status of the infrastructure. Elements currently under attack are highlighted with visual indicators (colours, icons, priorities) and accompanied in real time by:
- the CVEs (Common Vulnerabilities and Exposures) detected and exploited during the attack;
- the attackers’ techniques and tactics according to the MITRE ATT&CK taxonomy, highlighted directly on the map.
| Map type | What it represents |
|---|---|
| Infrastructure | The hierarchical and technical representation of physical and virtual components: servers, switches, firewalls, sensors. |
| Topological | Connections and logical dependencies between systems, highlighting critical or isolated points. |
| Functional | Services and business processes, correlated with the underlying technology entities. |
From the node under attack to the details
Security information is integrated into the multi-level maps: every node or technical component visible on the map shows its associated security status. With drill-down, the operator opens the details of each element under attack and consults:
- real-time metrics;
- indicators of compromise;
- related CVEs;
- observed MITRE ATT&CK techniques.
Multi-level maps, real-time security data and topological representation work together, in federated or distributed scenarios too.
On-premise, stand-alone or federated
Sentinet³ is installed on-premise, on physical or virtualised systems, with no dependency on external cloud components. Installations are scalable, both stand-alone and federated, with configurations optimised for:
- environments with a high density of hosts and services;
- segmentation by department, domain or operational context.
Find out more. The platform’s self-protection measures are described on the Security page; sizes and configurations in Appliances and deployment.
Related topics
Want to see Sentinet³ on your infrastructure?
Tell us about your environment: sites, technologies, critical services. We will show you how Core and Infinity can work on your case.