SOAR App Host architecture

The architecture consists mainly of the SOAR Platform, App Host, container repository, and connections to any security applications.

The App Host, , provides a container environment for each app. The instances of the App Host run in a Kubernetes k3s environment.

From the SOAR Platform, you download and install one or more apps from the IBM Security® App Exchange then configure and test the app and assign it to an App Host. When this is done, the app is available for use. By default, the App Host connects to the IBM® official repository, quay.io, to access the app's executable; however, you can configure the App Host to use your own repository.

The SOAR Platform can reside in your own environment (known as an on-premises configuration) or within the IBM Cloud® (also known as a SaaS configuration). The App Host resides in your environment and must be able to access the SOAR Platform, the quay.io repository (or your own repository), and the hosts of the third-party applications that are integrated with the SOAR Platform.

The following diagram illustrates the data flow between an App Host and a SOAR organization.

Architecture diagram

You can have multiple App Hosts paired to a single organization.

Optionally, you can download apps to a local system in your environment then install them in the SOAR Platform. You can also install and configure your own repository for the app executables instead of accessing the quay.io site. Each App Host supports only one repository for executables.

If you have the SOAR for MSSPs add-on, you pair App Hosts with child organizations only. You do not pair an App Host with the configuration organization or global dashboard.