TECHNICAL SPECIFICATION
Zero-Egress Containerised Deployment — Every AQRA Engagement by Default.
AQRA is architected from the ground up for environments where data cannot leave the perimeter. This specification covers the deployment model, network isolation requirements, and offline update delivery that make air-gapped discovery possible.
- Zero Egress Network Isolation Verification
- Hardened Container Image (VMware, KVM, Hyper-V, Bare Metal)
- Offline Signature & Rule Media Updates
CONTENTS
What This Document Covers
The architectural principles and operational requirements enabling AQRA to execute cryptographic discovery and CBOM generation inside zero-trust perimeters.
Container Deployment Model
AQRA ships as a hardened container image, deployable on your existing virtualisation or bare-metal infrastructure — VMware, KVM, Hyper-V, or hardware. No proprietary hardware dependency. No vendor lock-in to a specific rack. The container's own network interfaces are configured to permit inbound connections from your internal tooling and outbound to nothing.
Network Isolation Requirements
The AQRA appliance has no required outbound network connectivity. Inbound connections for read-only repository access are established from the appliance to internal source control — not from external systems into the appliance. SPAN/TAP mirroring for runtime discovery uses a passive interface that cannot transmit. A host-level firewall rule dropping all outbound traffic verifiably enforces the zero-egress requirement.
DMZ and SOC Placement
Recommended placement: inside a dedicated discovery subnet within the SOC environment, isolated from both the production network and the external-facing DMZ. Read-only access to the source repositories required; no write access to any system. Firewall policy allows: inbound repository API calls (internal only), inbound SOC management access. Denies: all outbound traffic.
Offline Signature and Rule Updates
AQRA's detection rules and cryptographic algorithm library are updated via controlled offline media transfer — a signed, verified package delivered on physical media or via a one-way data diode from an isolated update workstation. Update packages are signed by Qvanticalabs' delivery team and verified by the appliance before application. No network pull is required or used.
SIEM / SOC Integration
CBOM findings and quantum-risk alerts are pushed to SIEM platforms (Splunk, IBM QRadar, Microsoft Sentinel) via Syslog or REST API from within the internal network. The integration is outbound from AQRA to the SIEM — not inbound from the SIEM to AQRA — and operates entirely within the internal network perimeter.
RELATED TECHNICAL INTELLIGENCE
Explore Related Research & Specifications
PQC Migration Blueprint
Engineering roadmap for discovering and migrating legacy algorithms to NIST standards.
Read Blueprint →CBOM Guide & Specification
Complete schema guide and taxonomy for CycloneDX 1.6 Cryptographic Bills of Materials.
Explore CBOM Guide →Financial Sector CBOM Report
Real-world deployment case study auditing 1,200+ repositories in banking DMZs.
Read Case Study →NEXT STEP
Ready to apply this to your environment?
A scoping call maps the relevant standards and specifications to your specific infrastructure and regulatory obligations.