Multi-Plane Isolation Topology & Network Segmentation
VulnerGuard is architected as a multi-plane containerized microservices stack segmented across isolated virtual networks and fronted by a hardened TLS 1.3 ingress gateway.
1. High-Level Network & Plane Topology
┌────────────────────────────────────────────────────────────────────────────────────────┐
│ PUBLIC TLS 1.3 EDGE INGRESS │
│ WAF & Edge TLS Proxy ──► https://vulnerguard.com │
└───────────────────────────────────────────┬────────────────────────────────────────────┘
│ Loopback Ingress Only
▼
┌────────────────────────────────────────────────────────────────────────────────────────┐
│ vg-edge-gateway (Unified Web & Reverse-Proxy Gateway) │
│ • / ──► React 18 Operator SPA • /api/* ──► vg-core-api │
│ • /docs/* ──► Docusaurus 3.10.2 Portal • /socket.io/* ──► vg-core-api │
│ • /cyberchef/* ──► vg-workbench-cyberchef • /pentestws/* ──► vg-pentestws │
└───────────────────┬────────────────────────────────────────────────┬───────────────────┘
│ │
▼ ▼
┌───────────────────────────────────────────┐ ┌───────────────────────────────────────┐
│ OFFENSIVE & AI ORCHESTRATION PLANE │ │ DEFENSIVE SOC & SOAR PLANE │
│ (Isolated Bridge Network) │ │ (Isolated Bridge Network) │
├───────────────────────────────────────────┤ ├───────────────────────────────────────┤
│ • vg-core-api │ │ • vg-soc-thehive │
│ REST API + Socket.IO + SecurityAgent ├───►│ Incident Response + Graph Store │
│ • vg-mcp-orchestrator │ │ • vg-soc-cortex │
│ Tool Executor + Headless Browser Plane │ │ Observable Enrichment Engine │
│ • vg-runtime-proxy │ │ • vg-soc-misp │
│ Scoped Container API Allowlist Proxy │ │ Threat Intelligence & IOC Platform │
│ • vg-vector-memory │ │ • vg-soc-shuffle │
│ High-Dimensional Vector Store │ │ SOAR Workflow & Playbook Engine │
│ • 14 Isolated Scanner Sandboxes: │ └───────────────────────────────────────┘
│ nmap · subfinder · katana · ffuf │
│ testssl · nuclei · zap · wpscan │
│ gitleaks · trivy · sqlmap │
│ metasploit · beef · set │
└───────────────────────────────────────────┘
2. Dual-Plane Network Segmentation
To enforce strict lateral-movement boundaries between offensive tool execution and defensive incident-response data stores, VulnerGuard separates workloads into two distinct network planes:
| Network Plane | Isolation Scope | Attached Logical Services |
|---|---|---|
| Offensive Execution Plane | Isolated Private Subnet | vg-edge-gateway, vg-core-api, vg-mcp-orchestrator, vg-vector-memory, vg-runtime-proxy, operator workbenches (vg-pentestws, vg-workbench-cyberchef), and all 14 offensive tool sandboxes. |
| Defensive SOC Plane | Isolated Private Subnet | vg-edge-gateway, vg-core-api (SOC Broker bridge), vg-soc-thehive (with dedicated backing indices), vg-soc-cortex, vg-soc-misp, and vg-soc-shuffle. |
Strict Lateral Segmentation
Offensive scanner containers (nmap, nuclei, metasploit, etc.) reside strictly on the Offensive Execution Plane and have zero network route to the databases or message queues inside the Defensive SOC Plane.
3. Logical Service Inventory
| # | Logical Service ID | Plane | Primary Operational Role |
|---|---|---|---|
| 1 | vg-edge-gateway | Ingress / Dual | React 18 SPA, Docusaurus /docs/ Portal, & Authenticated Reverse Proxy |
| 2 | vg-core-api | Offensive / SOC | Core REST API, Socket.IO Telemetry Server, SecurityAgent, & SOC Broker |
| 3 | vg-mcp-orchestrator | Offensive | MCP Tool Execution Plane & Headless Chromium/Playwright Automation Service |
| 4 | vg-runtime-proxy | Offensive | Hardened Allowlist Filter governing container execution calls |
| 5 | vg-vector-memory | Offensive | Vector Similarity Database for security_findings and scan_history |
| 6–19 | vg-worker-<engine> (×14) | Offensive | Dedicated isolated containers for each of the 14 offensive security tools |
| 20 | vg-workbench-pentestws | Offensive | Penetration Testing Engagement Workspace |
| 21 | vg-workbench-cyberchef | Offensive | Local CyberChef Data & Payload Analysis Workbench |
| 22–24 | vg-soc-thehive (+ Store/Index) | SOC | TheHive Incident Response & Case Management Cluster |
| 25 | vg-soc-cortex | SOC | Cortex Observable Enrichment & Analyzer Engine |
| 26 | vg-soc-misp (+ Store/Cache) | SOC | MISP Threat Intelligence & IOC Correlation Cluster |
| 27–28 | vg-soc-shuffle (+ Index) | SOC | Shuffle SOAR Workflow & Automation Cluster |