Architecture
Deployment architecture of the server and its components
- Forestall is installed on only one Microsoft Windows server in your network. It doesn’t require any agent deployment to servers, clients, domain controllers or cloud environments.
- Forestall works with an unprivileged user to scan the entire Active Directory. Active Directory data never leaves the server.
- Cloud providers are scanned through their APIs over outbound HTTPS (see Requirements). No inbound connection from the cloud to the server is needed.
- In hybrid environments, identities synchronized from on-premises Active Directory to Microsoft Entra ID are correlated, so attack paths that cross from AD to the cloud are visible.
- Cloud providers are optional. Each is enabled by adding its configuration in Configuration Center.
Components
All components run on the Forestall server:
| Component | Role |
|---|---|
| Web interface | IIS site FSProtect-Frontend, HTTPS 443. |
| REST API | IIS site FSProtect-Django (Python), HTTPS 8443. Serves the web interface, API clients and the MCP server for AI clients. |
| Core | IIS site FSProtect-Core (.NET Framework 4.7.2), HTTPS 5443. Runs scans and background jobs with Hangfire. |
| Active Directory scanner | Part of Core. Collects data from domain controllers and domain computers over LDAP, SMB, RPC and the other ports listed in Requirements. |
| CloudCollector | Started by Core for each scan that includes Azure, AWS, GCP or GitHub. Collects data through the provider APIs and exits when the collection is done. |
| FSShareEnum | Started by Core for Credential Discovery. Enumerates SMB shares and scans files for secrets. |
| Neo4j 4.4.8 | Graph database: objects, relationships and attack paths. |
| PostgreSQL 15 | Relational database: users, settings, issue details, the Hangfire job queue, and AI Assistant data (pgvector). |
External connections
The server connects out only to the systems you configure:
- Cloud provider APIs of the environments you scan (Microsoft Graph and Azure Resource Manager, AWS, Google Cloud and Google Workspace, GitHub).
- An AI provider, if you configure one for the AI Assistant. Self-hosted providers keep the data in your network. Cloud providers receive the questions and, with Full access, scan data.
- Optional integrations: Jira, Splunk, mail (SMTP), CyberArk, LDAP and SSO identity providers.
license.forestall.iofor Check for Updates (optional, see Update).
Deployment architecture