Greenfield ZIA + ZPA architecture
Identity, posture, policy and telemetry designed as one production control plane.
Zero Trust · SASE · Multi-geo SOC
Architecture that survives contact with production.
EuphoriaSec turns identity, secure access and hybrid SIEM complexity into explicit decisions, working controls and operational evidence—from reference architecture to CLI.
- Architecture
- Engineering
- Operations
Enterprise PoV to evidence
Validate integrations, failure modes and operational ownership before scale.
Regional evidence. One operating model.
Elastic on-prem and regional Sentinel workspaces operated through Lighthouse.
Architecture lab
Change the context. Watch the architecture decision change.
Architecture is not a picture of products. It is a repeatable way to turn signals, constraints and risk into an explainable control path.
Architecture decision workbench
Model, not mock-up
HOW TO READ THIS MODEL
Choose a scenario. Every click on Identity, Device, Context or Resource cycles that signal’s state and recalculates risk, enforcement and rationale.
2 · Inspect a decision signalClick a card to see why it changes the decision
12risk
Policy engine
Zidentity · ZIA · ZPA
Decision
ALLOW
via ZPA
01Authenticate
02Attest
03Evaluate
04Enforce
Identity signalCURRENT STATE · VERIFIED
Entra authentication and SCIM group context establish who is asking, not what network they came from.
NLSentinel NLRegional workspace42 analytics
EUSentinel EURegional workspace39 analytics
CLSentinel CloudRegional workspace47 analytics
LHAzure LighthouseDelegated cross-tenant management3 tenants
SOCMulti-geo SOCQueries · analytics · incidents0 active P1
STANDBY
SIMULATION · SANITISED SCENARIO
Attack path: privileged token replay
Run the scenario to follow one identity from the on-prem signal through regional detections, cross-workspace correlation and containment.
- Elastic on-premAwaiting source event
- Sentinel NLAwaiting analytic
- Sentinel CloudAwaiting replay signal
- LighthouseAwaiting correlation
- SOC containmentAwaiting triage
FocusAll regions
Data & control pathElastic on-prem → Sentinel NL; regional feeds → Sentinel EU/Cloud; all workspaces → Lighthouse → SOC
Architecture boundaryTelemetry stays in its regional workspace; management is delegated.
SOC outcomeCross-workspace visibility without collapsing tenants or geographies.
Architecture practice
Decisions, controls and evidence stay connected.
The value is not a list of products. It is knowing where trust changes, who owns the decision and how production proves it works.
WHERE THE ARCHITECTURE DEPTH SITS
ZT
Identity-to-application control
Translate Entra identity, Intune posture, application criticality and data policy into ZIA/ZPA enforcement—with an explicit exception and evidence model.
SOC
Regional evidence, federated operation
Keep Elastic on-prem and Sentinel data boundaries intentional while Lighthouse enables one detection, investigation and escalation model.
ENG
Architecture that can be executed
Turn decisions into policy, APIs, Terraform, validation tests and runbooks so the design survives handover and change.
UnderstandMap trust boundaries and failure modes
→
DecideRecord ownership and trade-offs
→
ProveValidate controls with production evidence
Start with the difficult part
Bring the architecture problem that spans teams, tenants or platforms.
Share the context, the constraint and what production-ready needs to mean. We will say directly whether we can help.
Direct email
hello@euphoriasecurity.nl
This site collects no contact data. Your email only leaves your device when you send it.