How arnavmahajan630/veyra works
Veyra is an air-gapped log preprocessor: it receives logs, seals raw events, normalizes them into OCSF with lineage and confidence tiers, routes them to a SIEM, and supports contract learning, drift review, and evidence verification. The principal path is source → ingest → Kafka → normalization → delivery; raw archiving and lineage indexing branch from the raw stream. Control-plane and evidence relationships are documented in the README, but most service-to-service wiring was not sampled, so those connections cite the README rather than implying inspected implementation details.
Main entry points: control_api/app.py Control API · ingest_gateway/app.py HTTP ingest · engine.py Normalization engine · App.tsx Web console
Components 34
Ingestion and custody
- Edge collectors
edge/render.py - HTTP ingest
services/ingest_gateway/src/ingest_gateway/app.py - Raw Kafka topics
- Raw archiver
services/archiver/src/archiver/archiver.py - Envelope models
packages/veyra_common/src/veyra_common/models/envelope.py - Shared settings and IDs
packages/veyra_common/src/veyra_common/settings.py - Shared logging
packages/veyra_common/src/veyra_common/logging.py - ID utilities
packages/veyra_common/src/veyra_common/ids.py
Normalize and deliver
- Normalizer service
services/normalizer/src/normalizer/control.py - Normalization engine
packages/veyra_engine/src/veyra_engine/engine.py - Normalized Kafka topics
- Delivery router
services/router/src/router/routes.py
Control and learning
- Control API
services/control_api/src/control_api/app.py - Control database
services/control_api/src/control_api/tables.py - Contracts and drafting
packages/veyra_contracts/src/veyra_contracts/drafting/drafter.py - Drift worker
services/drift_worker/src/drift_worker/worker.py - Session and role auth
services/control_api/src/control_api/auth.py - Control context
services/control_api/src/control_api/context.py - Contract workflow routes
services/control_api/src/control_api/routes_contracts.py - Source and key routes
services/control_api/src/control_api/routes_sources.py
Evidence and lineage
- Sealed vault
- Lineage indexer
services/lineage_indexer/src/lineage_indexer/indexer.py - Lineage store
- Evidence API
services/evidence_api/src/evidence_api/app.py - Integrity verifier
services/integrity/src/integrity/integrity.py - Hashing utilities
packages/veyra_common/src/veyra_common/hashing.py - Shared record models
packages/veyra_common/src/veyra_common/models/__init__.py
Operator console
- Web console
console/src/App.tsx - Console API client
console/src/api/client.ts - Hotkey registry
console/src/hotkeys/registry.ts - Query client
console/src/shell/queryClient.ts
Other components
- Log sources
- Wazuh / SIEM
- Operators
Connections 38
- Log sources → Edge collectors: send syslog
README.md - Log sources → HTTP ingest: send HTTP
README.md - Edge collectors → Raw Kafka topics: publish raw
README.md - HTTP ingest → Raw Kafka topics: publish raw
README.md - Raw Kafka topics → Raw archiver: consume raw
README.md - Raw archiver → Sealed vault: seal raw
README.md - Raw Kafka topics → Normalizer service: consume raw
README.md - Normalizer service → Normalization engine: normalize
- Normalization engine → Normalized Kafka topics: emit OCSF
- Normalized Kafka topics → Delivery router: consume normalized
README.md - Delivery router → Wazuh / SIEM: deliver events
README.md - Normalized Kafka topics → Lineage indexer: index lineage
README.md - Lineage indexer → Lineage store: write records
README.md - Lineage store → Evidence API: query lineage
- Sealed vault → Integrity verifier: verify seals
README.md - Operators → Web console: operate
README.md - Web console → Console API client: request API
- Console API client → Control API: call REST
README.md - Control API → Control database: read/write
- Control API → Contracts and drafting: manage contracts
README.md - Control API → Drift worker: review drift
README.md - Control API → HTTP ingest: publish control
README.md - Control API → Normalizer service: publish control
README.md - Control API → Session and role auth: authenticate routes
- Control API → Control context: provide shared context
- Contract workflow routes → Control context: use context
services/control_api/src/control_api/routes_contracts.py - Source and key routes → Control context: use context
services/control_api/src/control_api/routes_sources.py - Web console → Query client: create query client
console/src/App.tsx - Web console → Hotkey registry: install listener
console/src/App.tsx - Normalization engine → Hashing utilities: uses hashing
packages/veyra_engine/src/veyra_engine/engine.py - Normalization engine → ID utilities: uses IDs
packages/veyra_engine/src/veyra_engine/engine.py - Normalization engine → Shared record models: uses record models
packages/veyra_engine/src/veyra_engine/engine.py - HTTP ingest → Envelope models: builds envelopes
services/ingest_gateway/src/ingest_gateway/app.py - HTTP ingest → Hashing utilities: uses hashing
services/ingest_gateway/src/ingest_gateway/app.py - HTTP ingest → Shared settings and IDs: uses settings
- Control API → Shared settings and IDs: uses settings
- Query client → Console API client: handles API errors
console/src/shell/queryClient.ts - Session and role auth → Control context: uses context
services/control_api/src/control_api/auth.py