Architecture: Investigate C4 Model for Diagrams

[opencybersecurityalliance]

Architecture: Investigate C4 Model for Diagrams

[adammontville]

Hi everyone. Earlier, Bill and I worked on trying to model some of the architecture using C4 modeling notation. I've attached our first pass as a series of PDF files starting with context, going into container, and then drilling down to components. The context only has a few systems represented: Threat Intelligence Sharing System (probably found somewhere in our existing diagrams), Configuration Policy Management System, and Posture Assessment System (the SCAPv2 architecture work).

We weren't quite sure if we were walking down the right path, but it's at least a start.

What would be great is if we got a couple of people to join the effort on the threat intelligence side, so that we could drill down from context into containers and components and show the more detailed points of connection.

context.pdf
container.pdf
component.pdf

[adammontville]

Bill found this McAfee Threat Intelligence Exchange overview that depicts ePolicy Orchestrator, Threat Intelligence Exchange Server, and Threat Intelligence Exchange VirusScan Enteprise Module - each connected via OpenDXL. What it doesn't depict is the categorical information going between them. I wonder if we couldn't use this as a start to show contextual connections in the diagrams we created.

[MitchellJThomas]

@adammontville Bill and I are planning on creating the next revision of the original C4 diagrams (attached to this issue and now in the branch mentioned above) and will create a Pull Request to include them in master if they are deemed acceptable by the architecture team.

[MitchellJThomas]

See #14 for activity on the diagrams.

[warrenrjwc]

I like the use of the Threat Intelligence Exchange overview but want to depict functional (vs product) interchanges. I think the key item we need to draft is the missing part you mentioned (the information exchanged between components). Can you map these product to the functions and align that with our current draft architecture?

[adammontville]

@warrenrjwc, I think we could do that. What I'm hoping for is a breakdown of what those functions are right now - I don't have the necessary insight into the threat intelligence subdomain myself to decompose the product view of the Threat Intelligence Exchange overview and then to identify the information that is being exchanged (at least not without making many assumptions).

[MitchellJThomas]

@wmunyan @adammontville and I are working an a new PR (this one from Bill's account) with further updates.

[MitchellJThomas]

On to part three!

[MitchellJThomas]

We should close this issue as we have looked into C4 model tool to use to draw our architecture diagrams and it seems to be useful for organizing these diagrams.