Chapter 4: Architecture Design

4.1 Typical System Topology

The reference topology organizes the log security system into three distinct security zones, each with its own trust boundary and network policy. This three-zone model is the minimum recommended architecture for any deployment that must satisfy compliance or forensic requirements. The Production Zone contains log sources and zone collectors; the Security Operations Zone contains the ingest, processing, and search infrastructure; and the Audit & Compliance Zone contains the immutable evidence vault and integrity services. Communication between zones is strictly controlled through firewall rules and allowlists.

Figure 4.1: Typical System Topology — Three-zone architecture (Production / SecOps / Audit & Compliance) with Kafka message queue, SIEM/Search cluster, WORM Raw Log Vault, and KMS/HSM governance layer

The topology diagram illustrates the complete data flow from log sources through the evidence chain. Log sources in the Production Zone generate events that are collected by the Zone Collector Pair (active-active configuration). The collectors forward log segments over mTLS to the Ingest Gateway Cluster in the SecOps Zone, which routes events through a Kafka message queue to the Parsing & Normalization Engine. From there, normalized events flow to the SIEM/Search Cluster for analyst access, while raw segments are simultaneously written to the Raw Log Vault in the Audit & Compliance Zone. The Integrity Service continuously verifies the hash chain of stored segments and produces verification manifests.

4.2 Equipment Cabling and Physical Connections

Physical cabling discipline is an often-overlooked aspect of log security architecture. Incorrect cabling can create unintended network paths that bypass security controls, allow unauthorized access to management interfaces, or create single points of failure that cause log loss. The reference cabling diagram shows the standard rack layout and cable routing for the core log security components, with color-coded cables to distinguish functional roles.

Figure 4.2: Equipment Cabling Diagram — Rack layout showing Zone Collector A/B (top), managed switch with mTLS-labeled cables, Ingest Gateway (middle), HSM appliance, and WORM-capable storage array (bottom) with color-coded cable management

The cabling diagram uses a four-color scheme to distinguish cable functions: blue for data network connections (syslog/TLS and mTLS), orange for fiber optic high-speed connections (10G between collectors and ingest gateway), red for management network connections (HTTPS/SSH), and yellow for power and out-of-band management. Each cable is labeled with the protocol and port number at both ends to facilitate troubleshooting and audit. The Zone Collector A and B servers are connected to the managed switch with separate blue cables, and the switch connects to the Ingest Gateway servers via orange fiber optic cables for high-throughput log forwarding.

4.3 Capacity Planning and Sizing

Capacity planning for a log security system requires modeling three independent dimensions: compute (for parsing and indexing), network (for log transport), and storage (for raw evidence and index). These dimensions scale differently with EPS, log verbosity, and retention requirements. The table below provides reference sizing parameters for three deployment tiers commonly encountered in practice.