# aditya160803/socverse-docs architecture

> Architecture diagram of the GitHub repository aditya160803/socverse-docs, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aditya160803/socverse-docs
- Repository: https://github.com/aditya160803/socverse-docs

## Overview

This repository is documentation for a cybersecurity lab covering infrastructure, attack simulation, Splunk monitoring, incident response, and threat intelligence. The file tree identifies these capabilities but provides no README or source excerpts, so their precise runtime sequence and integration ownership cannot be verified. The graph preserves the documented domains without inventing connections between them.

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_core["Lab foundation"]
  node_lab["Lab setup<br/>[lab-setup.md]"]
  node_architecture["Architecture overview<br/>[architecture.md]"]
  node_simulation["Attack simulation<br/>[index.md]"]
end

subgraph group_monitoring["Monitoring"]
  node_splunk["Splunk<br/>[splunk.md]"]
  node_detections["Detection rules<br/>[index.md]"]
  node_generic["Generic detections<br/>[generic-rules.md]"]
  node_wannacry["WannaCry detections<br/>[wannacry-rules.md]"]
  node_dashboards["Dashboards<br/>[index.md]"]
end

subgraph group_response["Incident response"]
  node_response["Incident response<br/>[index.md]"]
  node_automation["n8n workflows"]
  node_thehive["TheHive"]
end

subgraph group_intel["Threat intelligence"]
  node_mitre["MITRE ATT&amp;CK"]
  node_threatintel["Threat intelligence"]
end

node_operator(("Lab operator"))

click node_lab "https://github.com/aditya160803/socverse-docs/blob/main/docs/overview/lab-setup.md"
click node_architecture "https://github.com/aditya160803/socverse-docs/blob/main/docs/overview/architecture.md"
click node_simulation "https://github.com/aditya160803/socverse-docs/blob/main/docs/simulation/index.md"
click node_splunk "https://github.com/aditya160803/socverse-docs/blob/main/docs/services/splunk.md"
click node_detections "https://github.com/aditya160803/socverse-docs/blob/main/docs/detection/index.md"
click node_generic "https://github.com/aditya160803/socverse-docs/blob/main/docs/detection/generic-rules.md"
click node_wannacry "https://github.com/aditya160803/socverse-docs/blob/main/docs/detection/wannacry-rules.md"
click node_dashboards "https://github.com/aditya160803/socverse-docs/blob/main/docs/dashboards/index.md"
click node_response "https://github.com/aditya160803/socverse-docs/blob/main/docs/incident-response/index.md"
click node_automation "https://github.com/aditya160803/socverse-docs/blob/main/docs/services/mitre-n8n-thehive.md"
click node_thehive "https://github.com/aditya160803/socverse-docs/blob/main/docs/services/mitre-n8n-thehive.md"
click node_mitre "https://github.com/aditya160803/socverse-docs/blob/main/docs/services/mitre-n8n-thehive.md"
click node_threatintel "https://github.com/aditya160803/socverse-docs/blob/main/docs/services/threat-intelligence.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_lab,node_architecture,node_simulation toneBlue
class node_splunk,node_detections,node_generic,node_wannacry,node_dashboards toneAmber
class node_response,node_automation,node_thehive toneMint
class node_mitre,node_threatintel toneRose
class node_operator toneIndigo
```

## Components

### Lab foundation

- [Lab setup](https://github.com/aditya160803/socverse-docs/blob/main/docs/overview/lab-setup.md): `docs/overview/lab-setup.md`
- [Architecture overview](https://github.com/aditya160803/socverse-docs/blob/main/docs/overview/architecture.md): `docs/overview/architecture.md`
- [Attack simulation](https://github.com/aditya160803/socverse-docs/blob/main/docs/simulation/index.md): `docs/simulation/index.md`

### Monitoring

- [Splunk](https://github.com/aditya160803/socverse-docs/blob/main/docs/services/splunk.md): `docs/services/splunk.md`
- [Detection rules](https://github.com/aditya160803/socverse-docs/blob/main/docs/detection/index.md): `docs/detection/index.md`
- [Generic detections](https://github.com/aditya160803/socverse-docs/blob/main/docs/detection/generic-rules.md): `docs/detection/generic-rules.md`
- [WannaCry detections](https://github.com/aditya160803/socverse-docs/blob/main/docs/detection/wannacry-rules.md): `docs/detection/wannacry-rules.md`
- [Dashboards](https://github.com/aditya160803/socverse-docs/blob/main/docs/dashboards/index.md): `docs/dashboards/index.md`

### Incident response

- [Incident response](https://github.com/aditya160803/socverse-docs/blob/main/docs/incident-response/index.md): `docs/incident-response/index.md`
- [n8n workflows](https://github.com/aditya160803/socverse-docs/blob/main/docs/services/mitre-n8n-thehive.md): `docs/services/mitre-n8n-thehive.md`
- [TheHive](https://github.com/aditya160803/socverse-docs/blob/main/docs/services/mitre-n8n-thehive.md): `docs/services/mitre-n8n-thehive.md`

### Threat intelligence

- [MITRE ATT&CK](https://github.com/aditya160803/socverse-docs/blob/main/docs/services/mitre-n8n-thehive.md): `docs/services/mitre-n8n-thehive.md`
- [Threat intelligence](https://github.com/aditya160803/socverse-docs/blob/main/docs/services/threat-intelligence.md): `docs/services/threat-intelligence.md`

### Other components

- **Lab operator**