Architecture

Four vantage points measure the same services. Everything they collect travels outbound over TLS to a Cloud Unit dedicated to you, and reaches your teams as dashboards, floor maps and alerts.

Every connection that crosses your network boundary starts on your side and goes out. The cloud WAN probes look back at your sites' public WAN addresses from outside.

Four vantage points

CNA measures the same services from four places, so a fault can be placed on a site, an application, a network hop or a device.

Vantage point	Where it runs	What it sees
Office sensors	Small appliances on or under desks in your offices	Application response, DNS, the network path hop by hop, Wi-Fi and speed tests, 24/7. Sensor types
Server and VM agent	Linux and Windows servers behind the service	CPU, memory, disk and network, critical processes, endpoint availability and certificate expiry. Infrastructure
End-user device agent	The user's own Windows device	The same view from the user's machine, while it is switched on. Laptop agent
Cloud WAN probes	The Cloud Unit, outside your network	Latency, loss and availability of each site's WAN circuits, one or two per site. WAN circuits

Sensors give a constant, device-independent view of each location. The end-user device agent shows what one user's machine is doing, but only while it is on. The two complement each other: sensors fine and laptops slow points to the device.

The Cloud Unit

Each client has its own Cloud Unit. It is not a shared, multi-tenant platform: your portal and your databases serve you alone, and no data is shared with other clients.

Component	What it does
Portal	Dashboards, floor maps, the AI assistant and the configuration forms. Single sign-on with your identity provider and role-based views. The portal
Metrics store	Holds the measurements: 90 days by default, longer at additional cost. Data and retention
Alert engine	Evaluates the alert rules built from the thresholds you set, and sends notifications. Alerting
Config and API	Holds the configuration set in the portal and serves it to sensors and agents when they ask for it.
Cloud WAN probes	Test the public WAN address of each site's circuits from outside.

How configuration reaches the devices

Everything is set in the portal, not on devices: sites, sensors, apps, Wi-Fi profiles, thresholds and recipients.

You change something in the portal. An app, a threshold, a Wi-Fi profile or an alert recipient, through a form. Every change is recorded in the configuration audit trail.
Devices follow within a poll cycle. Sensors and agents check in with the Cloud Unit and pick up the change. Nothing has to be pushed into your network.
Alert rules regenerate automatically. Thresholds become alert rules without anyone writing a rule by hand.

Your network boundary

Connection	Direction	Notes
Sensor and agent measurements	Outbound	TLS only.
Configuration and updates	Outbound	The device asks; the Cloud Unit answers.
Management sessions	Outbound	Encrypted and started by the device, so no inbound firewall rules are needed. Ports.
Cloud WAN probes	From the cloud to your public WAN address	Tests the circuit itself, not hosts behind it. If a circuit blocks ping, the probe switches to trace mode.
Portal users	Your browser to the portal	Single sign-on, with optional source-IP or VPN restriction.

Nothing listens on the sensors. See Network requirements for what to allow, and Security for the controls and the independent assurance.

Agent updates and change safety

Agents keep themselves up to date.
An agent checks a new configuration before applying it.
New agent versions are proved on reference servers before the whole estate takes them: rollouts are staged.

Deployment options

Option	What it means
Cloud service	The standard deployment. CNA runs and manages your dedicated Cloud Unit.
Cloud Unit in your private environment	For clients who want to keep the monitoring data in their own private hosting or cloud environment. CNA still manages the Cloud Unit. Priced differently: see Pricing.
Split collection	Large estates can split collection onto dedicated servers.
Cloud provider monitoring	An add-on that brings AWS, Azure and Google Cloud Platform data, read through each provider's API, into the portal alongside CNA's own measurements.