> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform Architecture

> Detailed breakdown of Snapsec's distributed architecture, event pipeline, data stores, and integration bus.

Snapsec is built as an event-driven, distributed enterprise security platform designed for high-throughput vulnerability ingestion, continuous reconnaissance, and scalable scanning workloads.

***

## Architectural Overview

```mermaid theme={null}
flowchart TD
    subgraph Ingestion_Layer["1. Ingestion & Sensors"]
        ASM_Eng["ASM Recon Engine"]
        VS_WAS["VS & WAS Scanners"]
        AI_Eng["AI Pentesting Engine"]
        Adapters["Cloud & CMDB Adapters"]
        Ext_Tools["External Scanners (30+)"]
    end

    subgraph Core_Pipeline["2. Processing & Normalization"]
        Queue["Event Bus (Kafka / Redis Streams)"]
        Normalizer["Vulnerability Normalization Engine"]
        Dedupe["Deduplication & Correlation"]
        Risk_Engine["TrueRisk™ Scoring Engine"]
    end

    subgraph Data_Storage["3. Data & Knowledge Graph"]
        PG[("PostgreSQL 15+ (Relational Metadata)")]
        Graph[("Asset Graph (Context & Blast Radius)")]
        DocStore[("Evidence Store (S3 / MinIO)")]
    end

    subgraph Delivery["4. User Interfaces & Automation"]
        WebUI["Web Console (React / Tailwind)"]
        API_GW["REST API Gateway"]
        Auto_Engine["Automation & SLA Engine"]
        Outbound["Jira / Slack / SIEM Webhooks"]
    end

    Ingestion_Layer --> Queue
    Queue --> Normalizer
    Normalizer --> Dedupe
    Dedupe --> Risk_Engine
    Risk_Engine --> Data_Storage
    Data_Storage --> Delivery
```

***

## Core Subsystems

### 1. Ingestion & Sensor Layer

* **Distributed Scanner Nodes**: Stateless scanner workers that can run in the cloud or as on-premise forwarders inside private VPCs.
* **Continuous Recon Sensors**: Passive and active reconnaissance workers querying certificate transparency logs, DNS resolvers, and network scopes.
* **Bidirectional Ingestion Adapters**: Native connectors pulling data from AWS, GCP, Azure, GitHub, GitLab, and Jira.

### 2. Normalization & TrueRisk™ Engine

* **Unified Schema Mapping**: Converts raw outputs from disparate scanners (Nessus, Qualys, Nuclei, Trivy, Burp, CodeQL) into a standardized Snapsec Finding Object.
* **Deduplication Engine**: Uses syntactic hashing (target URL, parameter, vulnerability type, CVE) to prevent duplicate alerts for recurring findings.
* **Dynamic Contextual Risk Scoring**: Incorporates asset business criticality, internet exposure status, and real-time exploit intelligence (EPSS, CISA KEV).

### 3. Data Tier

* **Relational Core**: High-performance PostgreSQL store managing tenant schemas, RBAC, scan policies, and audit trails.
* **Evidence Storage**: S3-compatible object storage storing full raw HTTP request/response payloads, screenshots, and command outputs.
* **Asset Knowledge Graph**: Graph database mapping dependency relationships between business units, applications, repositories, APIs, and infrastructure.

***

## High Availability & Scalability

* **Horizontal Worker Auto-Scaling**: Worker pools for heavy scanning and pentesting scale independently based on queue depth.
* **Database Read Replicas**: Intensive reporting and search queries are offloaded to read replicas to preserve transaction throughput.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.