Clariti Docs

On-Premises Connectors

Some security tools live behind your firewall and can't be reached directly from the cloud. The Clariti Connector is a lightweight Docker container you deploy on-premises that bridges those tools into your Clariti dashboard.

How It Works

  1. You create a connector in the Clariti dashboard and get a one-time registration token.
  2. You deploy the Docker container on a machine inside your network.
  3. The connector registers using the token, establishing a secure outbound-only link.
  4. It polls Clariti every 30 seconds, uploading health data and adapter results, and downloading any pending commands.

All communication is outbound HTTPS from the connector to Clariti. No inbound firewall rules are required.

Architecture

┌─────────────────────────────┐        ┌──────────────────────┐
│  Your Network               │        │  Clariti Cloud        │
│                             │        │                      │
│  ┌─────────────┐            │  HTTPS │  ┌────────────────┐  │
│  │ On-Prem     │◄───────────┼────────┼──│ Connector API  │  │
│  │ Tools       │            │  (out) │  │                │  │
│  │ (AD, SIEM)  │            │        │  └────────────────┘  │
│  └──────┬──────┘            │        │                      │
│         │                   │        │  ┌────────────────┐  │
│  ┌──────▼──────┐            │        │  │ Dashboard      │  │
│  │ Clariti     │────────────┼───────►│  │                │  │
│  │ Connector   │  poll/push │        │  └────────────────┘  │
│  └─────────────┘            │        │                      │
└─────────────────────────────┘        └──────────────────────┘

Security Model

  • Outbound only — the connector initiates all connections. No listening ports are needed on your firewall.
  • Certificate pinning — the connector validates the Clariti cloud certificate to prevent man-in-the-middle attacks.
  • Encrypted credentials — on-prem tool credentials are encrypted at rest with Fernet encryption. They are held in memory only during active adapter runs.
  • Hardened container — runs as non-root, read-only filesystem, all Linux capabilities dropped, memory-limited to 512 MB.
  • Kill switch — Clariti administrators can instantly disable a connector from the cloud dashboard.

What Can It Monitor?

The connector supports adapters for:

  • HTTPS APIs — any on-prem tool with a REST API (e.g., on-prem SIEM, vulnerability scanner)
  • LDAP / Active Directory — users, computers, groups, and OUs
  • SSH — network device configurations (Cisco ASA, firewalls)
  • SNMP — network device discovery and interface monitoring

Next Steps