Chapter 4: Architecture Design

4.1 Logical Network Topology

The logical topology of a cybersecurity monitoring system defines the security zones, traffic flows, and monitoring collection points that together provide comprehensive visibility. The reference architecture follows a defense-in-depth model with distinct security zones, each with its own monitoring requirements and data collection strategy. The SIEM platform sits at the center of the monitoring architecture, receiving normalized event data from all zones through dedicated log collection infrastructure.

Figure 4.1: Cybersecurity Monitoring System Logical Network Topology — Multi-zone architecture with perimeter security, DMZ, internal network zones, and centralized SIEM with SOC workstations.

The topology is organized into five primary security zones, each with distinct monitoring requirements. The perimeter zone captures all north-south traffic between the organization and the internet, providing the first line of detection for inbound threats and outbound data exfiltration. The DMZ zone monitors traffic to and from publicly accessible services, capturing web application attacks and proxy bypass attempts. The internal network zones require east-west traffic monitoring to detect lateral movement, which is the most critical detection gap in traditional perimeter-focused architectures.

4.2 Physical Device Wiring & Rack Layout

The physical wiring diagram defines the actual cable connections between monitoring components in the data center rack. Proper physical design is critical for ensuring that monitoring traffic does not interfere with production traffic, that management access is isolated on a separate out-of-band network, and that the system can survive individual component failures without losing monitoring coverage. The reference rack layout places all monitoring components in a dedicated security rack with redundant power and cooling.

Figure 4.2: Physical Device Wiring and Connection Diagram — Rack-mounted monitoring equipment with color-coded cable connections: fiber optic (orange) for data capture, Ethernet (blue) for log forwarding, management (green) for OOB access, and storage (purple) for data persistence.

The color-coded cable scheme is a critical operational practice that enables rapid troubleshooting and reduces the risk of accidental disconnection. Each cable type serves a distinct function: fiber optic cables carry the high-bandwidth monitoring traffic from network TAPs to the log collector; standard Ethernet cables carry processed log data between components; the out-of-band management network provides secure administrative access that remains available even if the production network is compromised; and storage cables connect the SIEM platform to the storage array for log persistence.

4.3 High Availability Architecture Patterns

A monitoring system that experiences downtime during an active security incident is a critical failure. High availability design ensures that the monitoring infrastructure remains operational even during component failures, maintenance windows, or capacity overloads. The HA architecture for cybersecurity monitoring systems requires careful consideration of each component's failure modes and the impact of that failure on monitoring coverage.

4.4 Architecture Sizing Guidelines

Proper sizing of the monitoring architecture is essential to ensure that the system can handle peak event volumes without dropping events or introducing unacceptable alert latency. The sizing model is based on the Events Per Second (EPS) metric, which represents the normalized event throughput after parsing and enrichment. The following table provides sizing guidelines for three deployment tiers based on organizational scale.