dotDefender Central Management is comprised of three decoupled components:
- Container -- MS-SQL server to be contacted locally or over TCP/IP
- Windows Service -- installed on the machine that will poll the dotDefender web servers
- GUI -- installed wherever there is a direct SQL connection to the DB

dotDefender Central Management communicates with dotDefender for IIS or Apache in the following manner:
- A Windows service residing on the CM server frequently polls the web servers using XML over HTTP Post requests
- The dotDefender ISAPI filter intercepts the above-mentioned requests and treats them as CM-issued commands
- The operations required by CM are carried out using the ISAPI filter, with a success indication sent as a response back to CM
- All information called back into CM is serialized as XML messages, and optionally encrypted using an SSL tunnel over the standard HTTP session
- Once it reaches CM, the data is converted into SQL queries to be sent into the MS-SQL server
- The dashboard / central log viewer crafts SQL queries according to the users' filtering/searching preference, and graphically displays the data