# arshiyamars/marsti architecture

> Architecture diagram of the GitHub repository arshiyamars/marsti, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/arshiyamars/marsti
- Repository: https://github.com/arshiyamars/marsti

## Overview

MarsTI is a small interactive threat-intelligence CLI. A user selects one provider or all providers, enters one or more indicators, and the CLI defangs and classifies each valid value before dispatching lookups. Provider adapters query external services, normalize responses through shared HTTP/result helpers, and return results for terminal display and CSV export; the CLI also configures file logging. README documents IP, domain, and hash support, but AbuseIPDB supports only IPs. The source excerpts show the main flow and provider integrations; no separate storage or processing layer is evident.

Main entry points: [`main.py`](https://github.com/arshiyamars/marsti/blob/main/main.py) (Interactive CLI), [`config/settings.py`](https://github.com/arshiyamars/marsti/blob/main/config/settings.py) (Runtime settings), [`api/virustotal.py`](https://github.com/arshiyamars/marsti/blob/main/api/virustotal.py) (VirusTotal adapter), [`api/abuseipdb.py`](https://github.com/arshiyamars/marsti/blob/main/api/abuseipdb.py) (AbuseIPDB adapter)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["CLI workflow"]
  node_cli["Interactive CLI<br/>[main.py]"]
end

subgraph group_shared["Shared API layer"]
  node_ioc["IOC normalization<br/>[__init__.py]"]
  node_settings["Runtime settings<br/>[settings.py]"]
  node_http["HTTP and results<br/>[__init__.py]"]
end

subgraph group_providers["Threat sources"]
  node_vt["VirusTotal adapter<br/>[virustotal.py]"]
  node_abuse["AbuseIPDB adapter<br/>[abuseipdb.py]"]
  node_otx["AlienVault OTX adapter<br/>[alienvault.py]"]
end

subgraph group_outputs["Run outputs"]
  node_terminal["Terminal report<br/>[main.py]"]
  node_csv["CSV reports<br/>[main.py]"]
  node_logs["Log file<br/>[main.py]"]
end

node_user(("CLI user"))
node_vtservice["VirusTotal"]
node_abuseservice["AbuseIPDB"]
node_otxservice["AlienVault OTX"]

node_user -->|"enters choices and IOCs"| node_cli
node_cli -->|"cleans and classifies"| node_ioc
node_cli -->|"dispatches lookup"| node_vt
node_cli -->|"dispatches lookup"| node_abuse
node_cli -->|"dispatches lookup"| node_otx
node_vt -->|"fetches and builds result"| node_http
node_abuse -->|"fetches and builds result"| node_http
node_otx -->|"fetches and builds result"| node_http
node_http -->|"reads timeout"| node_settings
node_vt -->|"reads API key"| node_settings
node_abuse -->|"reads API key and age"| node_settings
node_otx -->|"reads API key"| node_settings
node_vt -->|"queries"| node_vtservice
node_abuse -->|"queries"| node_abuseservice
node_otx -->|"queries"| node_otxservice
node_vt -->|"returns result"| node_cli
node_abuse -->|"returns result"| node_cli
node_otx -->|"returns result"| node_cli
node_cli -->|"renders results"| node_terminal
node_cli -->|"writes report"| node_csv
node_cli -->|"configures logging"| node_logs
node_settings -->|"provides output path"| node_csv
node_settings -->|"provides output path"| node_logs

click node_cli "https://github.com/arshiyamars/marsti/blob/main/main.py"
click node_ioc "https://github.com/arshiyamars/marsti/blob/main/api/__init__.py"
click node_settings "https://github.com/arshiyamars/marsti/blob/main/config/settings.py"
click node_http "https://github.com/arshiyamars/marsti/blob/main/api/__init__.py"
click node_vt "https://github.com/arshiyamars/marsti/blob/main/api/virustotal.py"
click node_abuse "https://github.com/arshiyamars/marsti/blob/main/api/abuseipdb.py"
click node_otx "https://github.com/arshiyamars/marsti/blob/main/api/alienvault.py"
click node_terminal "https://github.com/arshiyamars/marsti/blob/main/main.py"
click node_csv "https://github.com/arshiyamars/marsti/blob/main/main.py"
click node_logs "https://github.com/arshiyamars/marsti/blob/main/main.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_user toneBlue
class node_ioc,node_settings,node_http toneAmber
class node_vt,node_abuse,node_otx toneMint
class node_terminal,node_csv,node_logs toneRose
class node_vtservice,node_abuseservice,node_otxservice toneIndigo
```

## Components

### CLI workflow

- [Interactive CLI](https://github.com/arshiyamars/marsti/blob/main/main.py): `main.py`

### Shared API layer

- [IOC normalization](https://github.com/arshiyamars/marsti/blob/main/api/__init__.py): `api/__init__.py`
- [Runtime settings](https://github.com/arshiyamars/marsti/blob/main/config/settings.py): `config/settings.py`
- [HTTP and results](https://github.com/arshiyamars/marsti/blob/main/api/__init__.py): `api/__init__.py`

### Threat sources

- [VirusTotal adapter](https://github.com/arshiyamars/marsti/blob/main/api/virustotal.py): `api/virustotal.py`
- [AbuseIPDB adapter](https://github.com/arshiyamars/marsti/blob/main/api/abuseipdb.py): `api/abuseipdb.py`
- [AlienVault OTX adapter](https://github.com/arshiyamars/marsti/blob/main/api/alienvault.py): `api/alienvault.py`

### Run outputs

- [Terminal report](https://github.com/arshiyamars/marsti/blob/main/main.py): `main.py`
- [CSV reports](https://github.com/arshiyamars/marsti/blob/main/main.py): `main.py`
- [Log file](https://github.com/arshiyamars/marsti/blob/main/main.py): `main.py`

### Other components

- **CLI user**
- **VirusTotal**
- **AbuseIPDB**
- **AlienVault OTX**

## Connections

- CLI user → Interactive CLI: enters choices and IOCs (evidence: `main.py`)
- Interactive CLI → IOC normalization: cleans and classifies (evidence: `main.py`)
- Interactive CLI → VirusTotal adapter: dispatches lookup (evidence: `main.py`)
- Interactive CLI → AbuseIPDB adapter: dispatches lookup (evidence: `main.py`)
- Interactive CLI → AlienVault OTX adapter: dispatches lookup (evidence: `main.py`)
- VirusTotal adapter → HTTP and results: fetches and builds result (evidence: `api/virustotal.py`)
- AbuseIPDB adapter → HTTP and results: fetches and builds result (evidence: `api/abuseipdb.py`)
- AlienVault OTX adapter → HTTP and results: fetches and builds result (evidence: `api/alienvault.py`)
- HTTP and results → Runtime settings: reads timeout (evidence: `api/__init__.py`)
- VirusTotal adapter → Runtime settings: reads API key (evidence: `api/virustotal.py`)
- AbuseIPDB adapter → Runtime settings: reads API key and age (evidence: `api/abuseipdb.py`)
- AlienVault OTX adapter → Runtime settings: reads API key (evidence: `api/alienvault.py`)
- VirusTotal adapter → VirusTotal: queries (evidence: `api/virustotal.py`)
- AbuseIPDB adapter → AbuseIPDB: queries (evidence: `api/abuseipdb.py`)
- AlienVault OTX adapter → AlienVault OTX: queries (evidence: `api/alienvault.py`)
- VirusTotal adapter → Interactive CLI: returns result (evidence: `main.py`)
- AbuseIPDB adapter → Interactive CLI: returns result (evidence: `main.py`)
- AlienVault OTX adapter → Interactive CLI: returns result (evidence: `main.py`)
- Interactive CLI → Terminal report: renders results (evidence: `main.py`)
- Interactive CLI → CSV reports: writes report (evidence: `main.py`)
- Interactive CLI → Log file: configures logging (evidence: `main.py`)
- Runtime settings → CSV reports: provides output path (evidence: `main.py`)
- Runtime settings → Log file: provides output path (evidence: `main.py`)