M3HT4 separates orchestration, scenario compute, telemetry, and presentation into purpose-built layers. The result is a controlled environment for authorized emulation, detection engineering, investigation, and collaborative training.
This is a deliberately public-safe view. Addressing, credentials, management endpoints, switch ports, firewall rules, and other operational security details are intentionally omitted.
The diagram communicates design intent and technology roles without publishing the information needed to administer or target the underlying environment.
Each system has a focused responsibility. Together they form the control, compute, detection, and presentation planes of M3HT4.
Provides the persistent management plane for orchestration, infrastructure visibility, controller services, monitoring, and future automation.
Runs persistent infrastructure workloads and will host disposable M3HT4 scenario environments separated from the public-facing platform.
The dedicated detection plane for network telemetry, packet analysis, event collection, and future Security Onion-backed workflows.
A dedicated display appliance for infrastructure health, scenario status, alerts, and real-time operational visibility.
The infrastructure exists to support a repeatable evidence lifecycle, not simply to host virtual machines.
A scenario begins with an objective, expected behavior, resource limits, telemetry goals, and explicit authorization.
Disposable workloads are created inside bounded scenario infrastructure rather than on persistent production systems.
Authorized behavior is executed within the scenario boundary to create representative security evidence.
Telemetry is collected through the monitoring and detection plane for investigation and validation.
Red, Blue, and Purple perspectives convert evidence into detections, lessons, and repeatable training material.
Only sanitized, intentionally selected outputs cross the boundary into the public M3HT4 experience.
The public platform and the private lab are intentionally treated as separate trust zones.
Control, compute, detection, and presentation are treated as distinct roles so a single service does not become the entire platform.
Scenario environments are designed around isolation first, with no assumption that an emulation workload requires public Internet access.
M3HT4 is built around the evidence produced by behavior—not around screenshots of individual security tools.
Raw evidence remains private. Public material is normalized, reviewed, and sanitized before publication.
The reference architecture shows both operating infrastructure and the direction of the platform. Planned capabilities are labeled rather than presented as finished.
Hunt the behavior. Detect what matters. Emulate safely. Turn the evidence into training.
