Architecture

Deployment architecture of the server and its components

• Forestall is installed on only one Microsoft Windows server in your network. It doesn't require any agent deployment to servers, clients, domain controllers or cloud environments.

• Forestall works with an unprivileged user to scan the entire Active Directory. Active Directory data never leaves the server.

• Cloud providers are scanned through their APIs over outbound HTTPS (see Requirements). No inbound connection from the cloud to the server is needed.

• In hybrid environments, identities synchronized from on-premises Active Directory to Microsoft Entra ID are correlated, so attack paths that cross from AD to the cloud are visible.

• Cloud providers are optional. Each is enabled by adding its configuration in Configuration Center.

Components

All components run on the Forestall server:

Component	Role
Web interface	IIS site FSProtect-Frontend, HTTPS 443.
REST API	IIS site FSProtect-Django (Python), HTTPS 8443. Serves the web interface, API clients and the MCP server for AI clients.
Core	IIS site FSProtect-Core (.NET Framework 4.7.2), HTTPS 5443. Runs scans and background jobs with Hangfire.
Active Directory scanner	Part of Core. Collects data from domain controllers and domain computers over LDAP, SMB, RPC and the other ports listed in Requirements.
CloudCollector	Started by Core for each scan that includes Azure, AWS, GCP or GitHub. Collects data through the provider APIs and exits when the collection is done.
FSShareEnum	Started by Core for Credential Discovery. Enumerates SMB shares and scans files for secrets.
Neo4j 4.4.8	Graph database: objects, relationships and attack paths.
PostgreSQL 15	Relational database: users, settings, issue details, the Hangfire job queue, and AI Assistant data (pgvector).

External connections

The server connects out only to the systems you configure:

• Cloud provider APIs of the environments you scan (Microsoft Graph and Azure Resource Manager, AWS, Google Cloud and Google Workspace, GitHub).

• An AI provider, if you configure one for the AI Assistant. Self-hosted providers keep the data in your network. Cloud providers receive the questions and, with Full access, scan data.

• Optional integrations: Jira, Splunk, mail (SMTP), CyberArk, LDAP and SSO identity providers.

• license.forestall.io for Check for Updates (optional, see Update).

Deployment architecture