Architecture

​

High-level shape

ThreatAware Protect is a multi-tenant SaaS hosted on AWS, with logical isolation between customer tenants, encrypted-at-rest data per tenant, and a fully managed update / operations model. Protect itself only initiates outbound HTTPS to vendor APIs. No inbound ports are exposed in your environment — the PowerShell Relay model lets Protect reach on-prem tools by having the relay dial out.

​

Tenant model

​

Data flow

1. Sync (every hour, per integration)
2. Vendor API → Protect ingest
3. Normalize → canonical schema
4. Match & dedupe (timeline algorithm)
5. Enrich — location, tags via Logic Engine
6. Compute Vitals per device/integration
7. Update Issues — open/close based on state changes
8. Action Center triggers — Continuous Actions re-evaluate
9. Automation fires — email / ticket / webhook
10. UI / API serves updated state

Step 1 happens continuously, parallel per integration. Each step is independent and idempotent — failures recover cleanly on the next sync.

​

Compute architecture

All compute is stateless — data lives in the database and object storage; restarts are zero-downtime.

​

Integration patterns

The PowerShell Relay is the key innovation for on-prem: outbound HTTPS only, no inbound firewall rules.

​

Cross-tool correlation engine

This is Protect’s signature component. Inputs:

• Every integration’s per-device payload, with timestamps
• Device matching signals (serial, hostname, MAC, user, IP, timeline)
• Tag rules (Logic Engine)

Outputs:

• Single unified device records (deduplication)
• Per-device Vital states per integration
• Function-stage detection: stale-in-tool-but-active-overall = broken

The algorithm is patented and tuned for environments up to 100,000+ devices.

​

High availability

​

Update model

Protect is a fully managed SaaS:

• Continuous deployment of fixes
• Backward-compatible API guarantees
• Per-tenant feature flags for staged rollouts
• Customer-facing changelog at the version chip

You don’t install or upgrade anything. The PowerShell Relay updates itself when the schedule task next runs.

​

Network egress

For on-prem integrations using the PowerShell Relay, outbound HTTPS 443 from the relay server. Required egress IPs / FQDNs are listed under AWS Account / IP Whitelist Info on the Settings → Integrations page.

​

See also