> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/introduction/architecture.md).

# Architecture

Deployment architecture of the server and its components

* Forestall is installed on only one Microsoft Windows server in your network. It doesn't require any agent deployment to servers, clients, domain controllers or cloud environments.
* Forestall works with an unprivileged user to scan the entire Active Directory. Active Directory data never leaves the server.
* Cloud providers are scanned through their APIs over outbound HTTPS (see [Requirements](/forestall/introduction/requirements.md)). No inbound connection from the cloud to the server is needed.
* In **hybrid environments**, identities synchronized from **on-premises Active Directory to Microsoft Entra ID** are correlated, so attack paths that cross from AD to the cloud are visible.
* Cloud providers are **optional**. Each is enabled by adding its configuration in [Configuration Center](/forestall/configuration-center.md).

## Components

All components run on the Forestall server:

| Component                    | Role                                                                                                                                                                                |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Web interface**            | IIS site `FSProtect-Frontend`, HTTPS 443.                                                                                                                                           |
| **REST API**                 | IIS site `FSProtect-Django` (Python), HTTPS 8443. Serves the web interface, API clients and the MCP server for AI clients.                                                          |
| **Core**                     | IIS site `FSProtect-Core` (.NET Framework 4.7.2), HTTPS 5443. Runs scans and background jobs with **Hangfire**.                                                                     |
| **Active Directory scanner** | Part of Core. Collects data from domain controllers and domain computers over LDAP, SMB, RPC and the other ports listed in [Requirements](/forestall/introduction/requirements.md). |
| **CloudCollector**           | Started by Core for each scan that includes Azure, AWS, GCP or GitHub. Collects data through the provider APIs and exits when the collection is done.                               |
| **FSShareEnum**              | Started by Core for [Credential Discovery](/forestall/credential-discovery.md). Enumerates SMB shares and scans files for secrets.                                                  |
| **Neo4j 4.4.8**              | Graph database: objects, relationships and attack paths.                                                                                                                            |
| **PostgreSQL 15**            | Relational database: users, settings, issue details, the Hangfire job queue, and AI Assistant data (`pgvector`).                                                                    |

## External connections

The server connects out only to the systems you configure:

* Cloud provider APIs of the environments you scan (Microsoft Graph and Azure Resource Manager, AWS, Google Cloud and Google Workspace, GitHub).
* An AI provider, if you configure one for the [AI Assistant](/forestall/ai-assistant.md). Self-hosted providers keep the data in your network. Cloud providers receive the questions and, with **Full access**, scan data.
* Optional integrations: Jira, Splunk, mail (SMTP), CyberArk, LDAP and SSO identity providers.
* `license.forestall.io` for **Check for Updates** (optional, see [Update](/forestall/introduction/update.md)).

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-9c54617d81249d3cbd7b43514ad33cf2f8a2a8b1%2Fintroduction-architecture-image-1.png?alt=media" alt="Forestall ISPM deployment architecture"><figcaption><p>Deployment architecture</p></figcaption></figure>