# PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation
## 4 PALANTIR General Architecture for Threat Remediation
### Orchestration of the Security Enablers  
The orchestration of the life cycle of the SCs is necessary for the SCs to act as Security Enablers, enacting the security functions or controls on a specific section of the managed infrastructure. The SO is the architectural building block that takes over this, acting as a central point that oversees the functioning of the SCs; extracting and concentrating information on both the available SCs and infrastructures where to deploy these. This introduces a logical layer that provides meaningful information to the rest of architectural building blocks from the platform, from a single access point and in a simplified manner prior. The interacting components can then use it to analyse a given status, select a given course of action and finally apply some action; where the action can be taken by another component or requested back to the SO, ultimately forming a feedback loop that can apply self-protection actions. Similarly, this layer can incorporate heuristics and internally enact actions on the infrastructure itself, where required to maintain the security of the overseen infrastructure. Finally, monitoring extraction and event notification are also triggered from this point to reach other components.  
As depicted in Figure 1, the SO interacts with the SCC so as to both upload (or onboard) new SC packages and extract later specific metadata contained in them, as well as with the SCHI for operations such as (i) requesting the deployment of a SC on a given infrastructure; (ii) enacting Day-0, Day-1 or Day-2 actions on the running SCs (understood as cloud-based actions that are triggered during instantiation, boot and run- time, respectively); (iii) deleting the SC instance; or by (iv) directly acting with the SCHI servers to either monitor their status or, potentially, directly execute security-related actions on them (e.g., isolate a given cluster).  
To accommodate the functionality explained above, the SO builds on top of tooling in the substrate layer. This layer is the SCHI, which comprises all resources that the infrastructure offers for the management of the SC running instances (typically, resources such as RAM or CPUs, which can be virtualised and accessed via containers or other virtual elements), as well as to physical resources that can be accessed to complement the functionality (e.g., crypto chips to assess integrity, such as the Trusted Platform Module (TPM) [49]) or tools related to infrastructure management (e.g., hypervisors such as KVM) or its orchestration (e.g., a Kubernetes cluster). The SCHI hosts virtualisation tools such as OpenStack, where each of them is considered VIM in the ETSI NFV terminology; alternatively, the NFVI hosts any other tools to support the operation. In addition to the SCHI, the SO is tightly integrated with an implementation of the NFV MANO component in the ETSI NFV architecture, named Open Source MANO (OSM) [50]. The MANO brings the orchestration logic to manage and oversee all the deployed NFV-based services, providing the SO with built-in integration with different VIMs such as OpenStack, as well as with tools in the NFVI that relate to (i) orchestration, typically Kubernetes (K8s) either running at public or on-premises clouds; and (ii) cloud frameworks that can, amongst others, enact the Day-0, Day-1 and Day-2 cloud-based configuration actions (i.e., via Juju [51] charms). In this integration with the ETSI NFV MANO, some ETSI NFV interfaces (or reference points) are specially relevant, as shown in Figure 1: (i) the _Or-Vi_ allows the MANO to communicate with the resources in the SCHI, whereas (ii) the _Ve-Vnft_ enables it to remotely execute the cloud-based configuration actions on the running SC instances. The latter interface can also be leveraged to provide inter-SC instance communication in a loose and easy manner. Roughly speaking, it could be somewhat compared to the _Nnf_ Service-Based Interface (SBI) from the control plane in SBA.