How abhilash-c-k/netriq-learn works
NETRIQ is a network intrusion detection and response platform. Its principal workflow is live traffic capture and feature extraction, threat prediction and risk evaluation, then alerting or mitigation; users also review incidents, analytics, and reports through the React interface. The graph includes authentication, persistence, and real-time telemetry as supporting capabilities. Several API and frontend internals were not sampled, so those relationships follow README documentation; links between sampled modules use the source index or excerpts.
Main entry points: services Application Services · monitor_service.py Live Monitor · response_engine.py Response Engine · main.py FastAPI Application
Components 27
User Interface
- React Dashboard
frontend/src/App.jsx - Dashboard Views
frontend/src/pages - API Client
frontend/src/services/api.js - Live Updates
frontend/src/hooks/useWebSocket.js
API and Services
- FastAPI Application
backend/main.py - REST Routers
backend/api - Authentication and RBAC
backend/auth/auth_service.py - Application Services
backend/services - Monitoring Service
backend/services/monitoring_service.py
Traffic Monitoring
- Packet Capture
backend/live_monitor/packet_sniffer.py - Live Monitor
backend/live_monitor/monitor_service.py - Flow Features
backend/live_monitor/feature_extractor.py
Threat Intelligence
- Heuristic Fallback
backend/live_monitor/heuristic_fallback.py - ML Predictor
backend/ai/predictor.py - Anomaly Detector
backend/ai/anomaly_detector.py - Prediction Fusion
backend/ai/fusion_engine.py - Risk Classification
backend/ai/risk_engine.py - Action Decision
backend/ai/decision_engine.py - Threat Explanations
backend/ai/explainability_engine.py
Response and Data
- Response Engine
backend/response/response_engine.py - Firewall Adapter
backend/response/firewall.py - Device Quarantine
backend/response/quarantine.py - Incident Service
backend/services/incident_service.py - MongoDB
backend/database/database.py - WebSocket Telemetry
backend/websocket/manager.py - Report Generation
backend/reports
Other components
- Analyst
Connections 26
- Analyst → React Dashboard: uses
README.md - React Dashboard → Dashboard Views: renders
frontend/src/App.jsx - Dashboard Views → API Client: requests data
- API Client → FastAPI Application: REST requests
README.md - Live Updates → WebSocket Telemetry: subscribes
README.md - FastAPI Application → REST Routers: registers
backend/main.py - REST Routers → Application Services: delegates
README.md - REST Routers → Authentication and RBAC: authenticates
backend/api/auth.py - Application Services → MongoDB: persists data
README.md - Application Services → Report Generation: generates exports
README.md - Monitoring Service → Live Monitor: starts monitor
backend/services/monitoring_service.py - Monitoring Service → WebSocket Telemetry: broadcasts status
backend/services/monitoring_service.py - Live Monitor → Packet Capture: uses
backend/live_monitor/monitor_service.py - Live Monitor → Flow Features: extracts features
backend/live_monitor/monitor_service.py - Live Monitor → Heuristic Fallback: falls back
backend/live_monitor/monitor_service.py - Live Monitor → Response Engine: dispatches actions
backend/live_monitor/monitor_service.py - Application Services → ML Predictor: requests predictions
backend/services/predict_service.py - Application Services → Anomaly Detector: requests anomaly score
backend/services/predict_service.py - Application Services → Prediction Fusion: fuses results
backend/services/predict_service.py - Application Services → Risk Classification: classifies risk
backend/services/predict_service.py - Application Services → Action Decision: chooses action
backend/services/predict_service.py - Application Services → Threat Explanations: explains predictions
backend/services/predict_service.py - Response Engine → Firewall Adapter: blocks IP
backend/response/response_engine.py - Response Engine → Device Quarantine: quarantines device
backend/response/response_engine.py - Response Engine → Incident Service: creates incident
backend/response/response_engine.py - FastAPI Application → WebSocket Telemetry: serves telemetry
README.md