# alaa-muhammad/sentinelcore architecture

> Architecture diagram of the GitHub repository alaa-muhammad/sentinelcore, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/alaa-muhammad/sentinelcore
- Repository: https://github.com/alaa-muhammad/sentinelcore

## Overview

SentinelCore is a host-based security-monitoring CLI. Its principal workflow is to collect live process, network, and file telemetry, identify suspicious activity, assess risk, and present operational and executive views; the README also documents correlation cases, alert/audit workflows, risk trends, scenario analysis, and recommendations. The CLI is the visible orchestrator. The supplied excerpts do not show the full scan loop or all repository wiring, so uncertain internal call edges are omitted.

Main entry points: [`main.py`](https://github.com/alaa-muhammad/sentinelcore/blob/main/main.py) (Interactive CLI), [`domain/models.py`](https://github.com/alaa-muhammad/sentinelcore/blob/main/domain/models.py) (Security domain models), [`collectors/process_collector.py`](https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/process_collector.py) (Process collector), [`collectors/network_collector.py`](https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/network_collector.py) (Network collector)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI orchestration"]
  node_cli["Interactive CLI<br/>[main.py]"]
  node_settings["Detection settings<br/>[settings.py]"]
end

subgraph group_collection["Telemetry collection"]
  node_collector_base["Collector adapter<br/>[base.py]"]
  node_process["Process collector"]
  node_network["Network collector"]
  node_filewatch["File watcher<br/>[file_watcher.py]"]
  node_intel["Threat intel adapter"]
  node_ioc["Local IOC list<br/>[ioc_local.csv]"]
end

subgraph group_analysis["Security analysis"]
  node_analyzer["Security analyzer"]
  node_risk["Risk engine<br/>[risk_engine.py]"]
  node_correlation["Correlation engine"]
  node_alerts["Alert service<br/>[alert_service.py]"]
  node_recommend["Recommendation engine"]
end

subgraph group_persistence["Domain and storage"]
  node_domain["Security domain models<br/>[models.py]"]
  node_database[("SQLite database<br/>[db.py]")]
end

subgraph group_presentation["Dashboards"]
  node_analyst["Analyst dashboard<br/>[dashboards.py]"]
  node_executive["Executive dashboard<br/>[dashboards.py]"]
end

node_operator(("Operator"))
node_host["Host OS"]
node_threat_feed["Threat feed"]

node_operator -->|"uses"| node_cli
node_cli -->|"starts collection"| node_process
node_cli -->|"starts collection"| node_network
node_cli -->|"starts monitoring"| node_filewatch
node_cli -->|"loads indicators"| node_intel
node_process -->|"reads processes"| node_host
node_network -->|"reads connections"| node_host
node_filewatch -->|"watches changes"| node_host
node_process -->|"uses thresholds"| node_settings
node_network -->|"uses thresholds"| node_settings
node_filewatch -->|"uses paths"| node_settings
node_intel -->|"loads indicators"| node_ioc
node_intel -.->|"may fetch feeds"| node_threat_feed
node_cli -->|"analyzes telemetry"| node_analyzer
node_cli -->|"scores findings"| node_risk
node_cli -->|"correlates events"| node_correlation
node_cli -->|"manages alerts"| node_alerts
node_cli -->|"generates insights"| node_recommend
node_cli -->|"shows operations"| node_analyst
node_cli -->|"shows summaries"| node_executive
node_cli -->|"uses repositories"| node_database
node_database -->|"stores entities"| node_domain
node_analyzer -->|"produces events"| node_domain
node_risk -->|"produces assessments"| node_domain
node_correlation -->|"produces cases"| node_domain
node_alerts -->|"creates alerts and audit"| node_domain
node_recommend -->|"produces recommendations"| node_domain

click node_cli "https://github.com/alaa-muhammad/sentinelcore/blob/main/main.py"
click node_settings "https://github.com/alaa-muhammad/sentinelcore/blob/main/config/settings.py"
click node_collector_base "https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/base.py"
click node_process "https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/process_collector.py"
click node_network "https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/network_collector.py"
click node_filewatch "https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/file_watcher.py"
click node_intel "https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/threat_intel_adapter.py"
click node_ioc "https://github.com/alaa-muhammad/sentinelcore/blob/main/config/ioc_local.csv"
click node_analyzer "https://github.com/alaa-muhammad/sentinelcore/blob/main/services/security_analyzer.py"
click node_risk "https://github.com/alaa-muhammad/sentinelcore/blob/main/services/risk_engine.py"
click node_correlation "https://github.com/alaa-muhammad/sentinelcore/blob/main/services/correlation_engine.py"
click node_alerts "https://github.com/alaa-muhammad/sentinelcore/blob/main/services/alert_service.py"
click node_recommend "https://github.com/alaa-muhammad/sentinelcore/blob/main/services/recommendation_engine.py"
click node_domain "https://github.com/alaa-muhammad/sentinelcore/blob/main/domain/models.py"
click node_database "https://github.com/alaa-muhammad/sentinelcore/blob/main/storage/db.py"
click node_analyst "https://github.com/alaa-muhammad/sentinelcore/blob/main/views/dashboards.py"
click node_executive "https://github.com/alaa-muhammad/sentinelcore/blob/main/views/dashboards.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_settings toneBlue
class node_collector_base,node_process,node_network,node_filewatch,node_intel,node_ioc toneAmber
class node_analyzer,node_risk,node_correlation,node_alerts,node_recommend toneMint
class node_domain,node_database toneRose
class node_analyst,node_executive,node_operator,node_host,node_threat_feed toneIndigo
```

## Components

### CLI orchestration

- [Interactive CLI](https://github.com/alaa-muhammad/sentinelcore/blob/main/main.py): `main.py`
- [Detection settings](https://github.com/alaa-muhammad/sentinelcore/blob/main/config/settings.py): `config/settings.py`

### Telemetry collection

- [Collector adapter](https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/base.py): `collectors/base.py`
- [Process collector](https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/process_collector.py): `collectors/process_collector.py`
- [Network collector](https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/network_collector.py): `collectors/network_collector.py`
- [File watcher](https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/file_watcher.py): `collectors/file_watcher.py`
- [Threat intel adapter](https://github.com/alaa-muhammad/sentinelcore/blob/main/collectors/threat_intel_adapter.py): `collectors/threat_intel_adapter.py`
- [Local IOC list](https://github.com/alaa-muhammad/sentinelcore/blob/main/config/ioc_local.csv): `config/ioc_local.csv`

### Security analysis

- [Security analyzer](https://github.com/alaa-muhammad/sentinelcore/blob/main/services/security_analyzer.py): `services/security_analyzer.py`
- [Risk engine](https://github.com/alaa-muhammad/sentinelcore/blob/main/services/risk_engine.py): `services/risk_engine.py`
- [Correlation engine](https://github.com/alaa-muhammad/sentinelcore/blob/main/services/correlation_engine.py): `services/correlation_engine.py`
- [Alert service](https://github.com/alaa-muhammad/sentinelcore/blob/main/services/alert_service.py): `services/alert_service.py`
- [Recommendation engine](https://github.com/alaa-muhammad/sentinelcore/blob/main/services/recommendation_engine.py): `services/recommendation_engine.py`

### Domain and storage

- [Security domain models](https://github.com/alaa-muhammad/sentinelcore/blob/main/domain/models.py): `domain/models.py`
- [SQLite database](https://github.com/alaa-muhammad/sentinelcore/blob/main/storage/db.py): `storage/db.py`

### Dashboards

- [Analyst dashboard](https://github.com/alaa-muhammad/sentinelcore/blob/main/views/dashboards.py): `views/dashboards.py`
- [Executive dashboard](https://github.com/alaa-muhammad/sentinelcore/blob/main/views/dashboards.py): `views/dashboards.py`

### Other components

- **Operator**
- **Host OS**
- **Threat feed**

## Connections

- Operator → Interactive CLI: uses
- Interactive CLI → Process collector: starts collection
- Interactive CLI → Network collector: starts collection
- Interactive CLI → File watcher: starts monitoring
- Interactive CLI → Threat intel adapter: loads indicators
- Process collector → Host OS: reads processes
- Network collector → Host OS: reads connections
- File watcher → Host OS: watches changes
- Process collector → Detection settings: uses thresholds
- Network collector → Detection settings: uses thresholds
- File watcher → Detection settings: uses paths
- Threat intel adapter → Local IOC list: loads indicators
- Threat intel adapter → Threat feed: may fetch feeds
- Interactive CLI → Security analyzer: analyzes telemetry
- Interactive CLI → Risk engine: scores findings
- Interactive CLI → Correlation engine: correlates events
- Interactive CLI → Alert service: manages alerts
- Interactive CLI → Recommendation engine: generates insights
- Interactive CLI → Analyst dashboard: shows operations
- Interactive CLI → Executive dashboard: shows summaries
- Interactive CLI → SQLite database: uses repositories
- SQLite database → Security domain models: stores entities
- Security analyzer → Security domain models: produces events
- Risk engine → Security domain models: produces assessments
- Correlation engine → Security domain models: produces cases
- Alert service → Security domain models: creates alerts and audit
- Recommendation engine → Security domain models: produces recommendations