Architectures

Recommended architectures for deploying the SIEM stack, based on different organisational contexts and resource levels. All are built to support forensic collection, threat detection, and incident response, while upholding survivor privacy and legal compliance. Each can be tailored to shelter environments, advocacy networks, or decentralised community deployments.

Shelter-centric on-prem deployment (Low-tech, all-in-one box)

Best for: Shelters with reliable internal networks and a designated tech advocate or volunteer.

  • Good for small shelters with no IT team
  • Can operate offline or semi-connected
  • Log import can be via USB if internet is risky

Architecture: Single-VM Local Shelter Deployment (Low-tech, all-in-one box)

+-------------------------+             +---------------------------+
|     Shelter Laptop      |             |    Optional PîRogue       |
|  (Ubuntu VM or host OS) |             |  (Field Analysis Device)  |
|-------------------------|             |---------------------------|
| - Wazuh Manager         |             | - PiRogue OS              |
| - Elasticsearch         |             | - Packet capture tools    |
| - Kibana                |             | - USB log import          |
| - setup.sh automation   |             +---------------------------+
+-------------------------+                       |
        |                                         |
        | Secure LAN / USB log import             |
        v                                         v
+--------------------------+            +----------------------------+
| Survivor Device Logs     |            |  Field Devices (e.g.       |
| (Windows/macOS/Android)  |            |  suspected tracking phone) |
+--------------------------+            +----------------------------+
  • One physical or virtual IPA-SIEM Server on-site
    • Runs Wazuh Manager, Elasticsearch, and Kibana
    • Hosts automated scripts (e.g., quarantine_device.sh, log parsers)
  • Wazuh agents installed on:
    • Windows/macOS devices (direct or via USB boot toolkit)
    • Android (via Termux on rooted devices)
    • iOS (jailbroken or offline backups)
  • Internal network used to route logs securely to the server
  • Optional hardened PiRogue device for local analysis and field triage

Pros: Data remains on-site; strong privacy control; Cons: Requires local technical maintenance and physical security.

Private cloud deployment (Shelter/NGO controlled)

Best for: Organisations needing remote access from multiple shelter sites or clinics.

  • Remote access for multi-location organisations
  • Needs strong VPN/tunnelling + encrypted backups
  • Lower on-site risk, but higher opsec discipline

Architecture: Secure Cloud-Based SIEM (e.g. Hetzner)

+------------------------------+
|     Encrypted Cloud VM       |
|------------------------------|
| - Wazuh Manager              |
| - Elasticsearch              |
| - Kibana                     |
| - HTTPS access (VPN optional)|
+------------------------------+
        |
        | Encrypted log transfer
        v
+------------------------------+
| Survivor Devices Anywhere    |
| (via Wazuh agent/ADB/iTunes) |
+------------------------------+

  • A cloud-hosted virtual machine (e.g., Hetzner, DigitalOcean) running:

    • Wazuh Manager + Elasticsearch + Kibana stack
    • Encrypted VPN access for shelters

  • Devices connect via secure tunnel (e.g., WireGuard)

  • Logs are anonymised before transmission using local scripts or secure USB transfer

Pros: Centralised visibility across locations; no physical maintenance; Cons: Requires cloud security knowledge; must enforce strict encryption and VPN access control

Portable analysis lab (offline-first)

Best for: Emergency triage, drop-in shelters, mobile advocacy, high-risk clients

  • Ideal for field work, clinics, house calls
  • No internet needed, everything local
  • Data can be wiped after export if needed

Architecture: Portable “Go Bag” SIEM (Raspberry Pi or Laptop)

+-----------------------------+
|   Portable Analyst Device   |
| (Linux Laptop or Pi 4)      |
|-----------------------------|
| - Wazuh Manager             |
| - Kibana (localhost only)   |
| - setup.sh portable mode    |
+-----------------------------+
        |
        | USB / Wi-Fi tethered logs
        v
+-----------------------------+
|  Survivor Device (offline)  |
+-----------------------------+
  • Ruggedised laptop or Pi-based forensic workstation with:
    • Full SIEM stack preloaded (Wazuh, Kibana, Elasticsearch)
    • Air-gapped or firewalled to prevent external leakage
  • USB boot tools used to gather data from survivor devices
  • Reports stored temporarily on encrypted volume
  • Can sync logs manually to a master system later

Pros: No internet required; maximum physical control; Cons: Limited by local disk space and computing power

Decentralised advocate pods

Best for: Networks of small organisations or distributed support workers

  • Multiple shelters feed anonymised data
  • Central support handles triage and evidence
  • Works best with dedicated tech partner

Architecture: Distributed Partner Org Setup (Shelters + Central Analyst)

+--------------------------+     +--------------------------+
|  Shelter Site A          |     |  Shelter Site B          |
|--------------------------|     |--------------------------|
| - Wazuh Agent/Collector  | --> | - Wazuh Agent/Collector  |
+--------------------------+     +--------------------------+
         \                           /
          \                         /
           v                       v
           +--------------------------+
           |  Central SIEM Analyst VM |
           |--------------------------|
           | - Wazuh Manager          |
           | - Elasticsearch + Kibana |
           +--------------------------+
  • Lightweight SIEM micro-nodes (e.g., Raspberry Pi 5 or mini PCs) deployed per advocate
  • Each node handles:
    • One or two devices at a time (USB or local Wi-Fi)
    • Real-time analysis with pre-loaded rulesets
  • Periodic sync to encrypted central node (monthly/weekly)

Pros: Highly flexible, low cost, resilient to infrastructure loss; Cons: Less central visibility; syncing is manual or periodic

Hybrid community network

Best for: Larger advocacy coalitions with rotating personnel or volunteers

  • For training, malware signature building, or law clinics
  • Can use replayed stalkerware traces
  • Must be fully sandboxed and isolated

Architecture: Lab Environment for Training or Forensics (Sandboxed)

+----------------------------+
|      Research VM(s)        |
|----------------------------|
| - Wazuh Manager            |
| - Infected VM images       |
| - Log replay or emulation  |
+----------------------------+
        |
        | Export clean evidence to real SIEM
        v
+----------------------------+
| Archive / Legal Evidence   |
+----------------------------+

  • A tiered system with:

    • One central cloud SIEM stack for coordination and long-term storage
    • Multiple field units (laptops or Pis) with preconfigured IPA-SIEM client scripts
    • Web UI for uploading manual logs if agents aren’t available

Pros: Combines best of both worlds—centralised security with local action; Cons: Requires good coordination and access controls between tiers

Design considerations

  • Data Privacy: Use full-disk encryption on all nodes. Logs should be anonymised by default unless explicit consent is obtained.
  • Audit Trails: All forensic actions should generate immutable logs to support legal admissibility.
  • Updates: Script-based updates (e.g., via Git or USB sync) should be regularly pushed to maintain detection accuracy.
  • Threat Signatures: Shared, updated rulepacks specific to IPA surveillance patterns (e.g., “Calculator+” malware, SIM spoofing logs).