# abhilash-c-k/netriq-learn architecture

> Architecture diagram of the GitHub repository abhilash-c-k/netriq-learn, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/abhilash-c-k/netriq-learn
- Repository: https://github.com/abhilash-c-k/netriq-learn

## Overview

NETRIQ is a network intrusion detection and response platform. Its principal workflow is live traffic capture and feature extraction, threat prediction and risk evaluation, then alerting or mitigation; users also review incidents, analytics, and reports through the React interface. The graph includes authentication, persistence, and real-time telemetry as supporting capabilities. Several API and frontend internals were not sampled, so those relationships follow README documentation; links between sampled modules use the source index or excerpts.

Main entry points: [`backend/services`](https://github.com/abhilash-c-k/netriq-learn/tree/main/backend/services) (Application Services), [`backend/live_monitor/monitor_service.py`](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/monitor_service.py) (Live Monitor), [`backend/response/response_engine.py`](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/response/response_engine.py) (Response Engine), [`backend/main.py`](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/main.py) (FastAPI Application)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["User Interface"]
  node_web["React Dashboard<br/>[App.jsx]"]
  node_ui_pages["Dashboard Views"]
  node_ui_api["API Client<br/>[api.js]"]
  node_ui_ws["Live Updates<br/>[useWebSocket.js]"]
end

subgraph group_api["API and Services"]
  node_app["FastAPI Application<br/>[main.py]"]
  node_routes["REST Routers"]
  node_auth["Authentication and RBAC<br/>[auth_service.py]"]
  node_services["Application Services"]
  node_monitor_api["Monitoring Service"]
end

subgraph group_monitor["Traffic Monitoring"]
  node_capture["Packet Capture<br/>[packet_sniffer.py]"]
  node_monitor["Live Monitor<br/>[monitor_service.py]"]
  node_features["Flow Features"]
end

subgraph group_intelligence["Threat Intelligence"]
  node_heuristic["Heuristic Fallback"]
  node_predictor["ML Predictor<br/>[predictor.py]"]
  node_anomaly["Anomaly Detector"]
  node_fusion["Prediction Fusion<br/>[fusion_engine.py]"]
  node_risk["Risk Classification<br/>[risk_engine.py]"]
  node_decision["Action Decision<br/>[decision_engine.py]"]
  node_explain["Threat Explanations"]
end

subgraph group_operations["Response and Data"]
  node_response["Response Engine<br/>[response_engine.py]"]
  node_firewall["Firewall Adapter<br/>[firewall.py]"]
  node_quarantine["Device Quarantine<br/>[quarantine.py]"]
  node_incidents["Incident Service"]
  node_database[("MongoDB<br/>[database.py]")]
  node_websocket["WebSocket Telemetry<br/>[manager.py]"]
  node_reports["Report Generation"]
end

node_analyst(("Analyst"))

node_analyst -->|"uses"| node_web
node_web -->|"renders"| node_ui_pages
node_ui_pages -.->|"requests data"| node_ui_api
node_ui_api -->|"REST requests"| node_app
node_ui_ws -->|"subscribes"| node_websocket
node_app -->|"registers"| node_routes
node_routes -->|"delegates"| node_services
node_routes -->|"authenticates"| node_auth
node_services -->|"persists data"| node_database
node_services -->|"generates exports"| node_reports
node_monitor_api -->|"starts monitor"| node_monitor
node_monitor_api -->|"broadcasts status"| node_websocket
node_monitor -->|"uses"| node_capture
node_monitor -->|"extracts features"| node_features
node_monitor -->|"falls back"| node_heuristic
node_monitor -->|"dispatches actions"| node_response
node_services -->|"requests predictions"| node_predictor
node_services -->|"requests anomaly score"| node_anomaly
node_services -->|"fuses results"| node_fusion
node_services -->|"classifies risk"| node_risk
node_services -->|"chooses action"| node_decision
node_services -->|"explains predictions"| node_explain
node_response -->|"blocks IP"| node_firewall
node_response -->|"quarantines device"| node_quarantine
node_response -->|"creates incident"| node_incidents
node_app -->|"serves telemetry"| node_websocket

click node_web "https://github.com/abhilash-c-k/netriq-learn/blob/main/frontend/src/App.jsx"
click node_ui_pages "https://github.com/abhilash-c-k/netriq-learn/tree/main/frontend/src/pages"
click node_ui_api "https://github.com/abhilash-c-k/netriq-learn/blob/main/frontend/src/services/api.js"
click node_ui_ws "https://github.com/abhilash-c-k/netriq-learn/blob/main/frontend/src/hooks/useWebSocket.js"
click node_app "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/main.py"
click node_routes "https://github.com/abhilash-c-k/netriq-learn/tree/main/backend/api"
click node_auth "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/auth/auth_service.py"
click node_services "https://github.com/abhilash-c-k/netriq-learn/tree/main/backend/services"
click node_monitor_api "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/services/monitoring_service.py"
click node_capture "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/packet_sniffer.py"
click node_monitor "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/monitor_service.py"
click node_features "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/feature_extractor.py"
click node_heuristic "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/heuristic_fallback.py"
click node_predictor "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/predictor.py"
click node_anomaly "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/anomaly_detector.py"
click node_fusion "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/fusion_engine.py"
click node_risk "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/risk_engine.py"
click node_decision "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/decision_engine.py"
click node_explain "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/explainability_engine.py"
click node_response "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/response/response_engine.py"
click node_firewall "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/response/firewall.py"
click node_quarantine "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/response/quarantine.py"
click node_incidents "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/services/incident_service.py"
click node_database "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/database/database.py"
click node_websocket "https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/websocket/manager.py"
click node_reports "https://github.com/abhilash-c-k/netriq-learn/tree/main/backend/reports"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_web,node_ui_pages,node_ui_api,node_ui_ws toneBlue
class node_app,node_routes,node_auth,node_services,node_monitor_api toneAmber
class node_capture,node_monitor,node_features toneMint
class node_heuristic,node_predictor,node_anomaly,node_fusion,node_risk,node_decision,node_explain toneRose
class node_response,node_firewall,node_quarantine,node_incidents,node_database,node_websocket,node_reports,node_analyst toneIndigo
```

## Components

### User Interface

- [React Dashboard](https://github.com/abhilash-c-k/netriq-learn/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [Dashboard Views](https://github.com/abhilash-c-k/netriq-learn/tree/main/frontend/src/pages): `frontend/src/pages`
- [API Client](https://github.com/abhilash-c-k/netriq-learn/blob/main/frontend/src/services/api.js): `frontend/src/services/api.js`
- [Live Updates](https://github.com/abhilash-c-k/netriq-learn/blob/main/frontend/src/hooks/useWebSocket.js): `frontend/src/hooks/useWebSocket.js`

### API and Services

- [FastAPI Application](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/main.py): `backend/main.py`
- [REST Routers](https://github.com/abhilash-c-k/netriq-learn/tree/main/backend/api): `backend/api`
- [Authentication and RBAC](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/auth/auth_service.py): `backend/auth/auth_service.py`
- [Application Services](https://github.com/abhilash-c-k/netriq-learn/tree/main/backend/services): `backend/services`
- [Monitoring Service](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/services/monitoring_service.py): `backend/services/monitoring_service.py`

### Traffic Monitoring

- [Packet Capture](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/packet_sniffer.py): `backend/live_monitor/packet_sniffer.py`
- [Live Monitor](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/monitor_service.py): `backend/live_monitor/monitor_service.py`
- [Flow Features](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/feature_extractor.py): `backend/live_monitor/feature_extractor.py`

### Threat Intelligence

- [Heuristic Fallback](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/live_monitor/heuristic_fallback.py): `backend/live_monitor/heuristic_fallback.py`
- [ML Predictor](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/predictor.py): `backend/ai/predictor.py`
- [Anomaly Detector](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/anomaly_detector.py): `backend/ai/anomaly_detector.py`
- [Prediction Fusion](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/fusion_engine.py): `backend/ai/fusion_engine.py`
- [Risk Classification](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/risk_engine.py): `backend/ai/risk_engine.py`
- [Action Decision](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/decision_engine.py): `backend/ai/decision_engine.py`
- [Threat Explanations](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/ai/explainability_engine.py): `backend/ai/explainability_engine.py`

### Response and Data

- [Response Engine](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/response/response_engine.py): `backend/response/response_engine.py`
- [Firewall Adapter](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/response/firewall.py): `backend/response/firewall.py`
- [Device Quarantine](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/response/quarantine.py): `backend/response/quarantine.py`
- [Incident Service](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/services/incident_service.py): `backend/services/incident_service.py`
- [MongoDB](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/database/database.py): `backend/database/database.py`
- [WebSocket Telemetry](https://github.com/abhilash-c-k/netriq-learn/blob/main/backend/websocket/manager.py): `backend/websocket/manager.py`
- [Report Generation](https://github.com/abhilash-c-k/netriq-learn/tree/main/backend/reports): `backend/reports`

### Other components

- **Analyst**

## Connections

- Analyst → React Dashboard: uses (evidence: `README.md`)
- React Dashboard → Dashboard Views: renders (evidence: `frontend/src/App.jsx`)
- Dashboard Views → API Client: requests data
- API Client → FastAPI Application: REST requests (evidence: `README.md`)
- Live Updates → WebSocket Telemetry: subscribes (evidence: `README.md`)
- FastAPI Application → REST Routers: registers (evidence: `backend/main.py`)
- REST Routers → Application Services: delegates (evidence: `README.md`)
- REST Routers → Authentication and RBAC: authenticates (evidence: `backend/api/auth.py`)
- Application Services → MongoDB: persists data (evidence: `README.md`)
- Application Services → Report Generation: generates exports (evidence: `README.md`)
- Monitoring Service → Live Monitor: starts monitor (evidence: `backend/services/monitoring_service.py`)
- Monitoring Service → WebSocket Telemetry: broadcasts status (evidence: `backend/services/monitoring_service.py`)
- Live Monitor → Packet Capture: uses (evidence: `backend/live_monitor/monitor_service.py`)
- Live Monitor → Flow Features: extracts features (evidence: `backend/live_monitor/monitor_service.py`)
- Live Monitor → Heuristic Fallback: falls back (evidence: `backend/live_monitor/monitor_service.py`)
- Live Monitor → Response Engine: dispatches actions (evidence: `backend/live_monitor/monitor_service.py`)
- Application Services → ML Predictor: requests predictions (evidence: `backend/services/predict_service.py`)
- Application Services → Anomaly Detector: requests anomaly score (evidence: `backend/services/predict_service.py`)
- Application Services → Prediction Fusion: fuses results (evidence: `backend/services/predict_service.py`)
- Application Services → Risk Classification: classifies risk (evidence: `backend/services/predict_service.py`)
- Application Services → Action Decision: chooses action (evidence: `backend/services/predict_service.py`)
- Application Services → Threat Explanations: explains predictions (evidence: `backend/services/predict_service.py`)
- Response Engine → Firewall Adapter: blocks IP (evidence: `backend/response/response_engine.py`)
- Response Engine → Device Quarantine: quarantines device (evidence: `backend/response/response_engine.py`)
- Response Engine → Incident Service: creates incident (evidence: `backend/response/response_engine.py`)
- FastAPI Application → WebSocket Telemetry: serves telemetry (evidence: `README.md`)