Dual-Tier Hybrid Architecture
Modern engineering organizations demand both zero-dependency execution in airgapped environments and immediate protection against newly published zero-day exploits. BlackShield resolves this tension through a two-tiered architecture:
Airgap & Disconnected Safety
Every scanner binary and appliance container ships with compiled-in vulnerability databases and attack signatures. Disconnected build environments, isolated VPCs, and local CLI runs execute without external calls or credentials.
On-The-Fly Zero-Day Retrieval
When authenticated against the BlackShield control plane, scanners and appliances issue conditional HTTP requests using If-None-Match headers. Updated definitions are cached atomically on disk and hot-reloaded without container restarts.
Pipeline & VM Scanner Integration
The BlackShield Pipeline Scanner checks for live advisories during SCA and SBOM analysis. If new CVEs exist, they are merged seamlessly with the built-in database:
Fail-Safe Caching Guarantee
If the control plane is unreachable or experiences network timeouts, the scanner falls back to local disk cache. If no cache exists, it defaults to the embedded database. Network failures never fail a production build.
Application WAF Hot-Reloading
The BlackShield Application Appliance continuously evaluates HTTP traffic against curated SQL injection, XSS, SSRF, RCE, and SSTI signatures. In background polling loops:
- Conditional Polling: Issues
GET /api/v1/signatures/wafwith the current ETag. A 304 response consumes minimal network bandwidth. - Zero-Downtime Hot Reload: Regex patterns are compiled in memory and swapped atomically under reader-writer locks, preventing dropped connections.
- Unified Policy Surface: Combines managed attack signatures, dynamic virtual patches, and threat-intel blocklist indicators into a unified evaluation pipeline.
Distribution Feed Endpoints
| Endpoint | Target Consumer | Caching Mechanism |
|---|---|---|
| GET /api/v1/signatures/advisories | Pipeline & VM Scanners | ETag, If-None-Match, max-age=300 |
| GET /api/v1/signatures/waf | Application WAF Appliance | ETag, If-None-Match, max-age=300 |
| GET /api/v1/signatures/status | Monitoring & Telemetry | ETag, If-None-Match, max-age=60 |