How arvindkumar-ship-it/dumpydox works
PS-08 combines insider-behavior analytics with API/agent-abuse defenses and a security console. The primary workflow accepts an event, normalizes and publishes it through an outbox, relays it to a stream consumer, scores behavior, and publishes high-risk alerts for dashboard review. Separate paths support session revocation, request-abuse checks, and websocket access. The README documents graph/isolation-forest/ensemble detection and autonomous responses; the tree supports only some of those implementations, so unsampled subsystems are represented at their existing directory paths without speculative wiring.
Main entry points: main.py FastAPI application · handlers.py Event handler · main.jsx Security console · session_revoke.py Session revocation
Components 27
API and Console
- Security console
frontend/frontend/src/main.jsx - FastAPI application
apps/api/app/main.py - Event endpoint
apps/api/app/api/v1/events.py - Dashboard endpoint
apps/api/app/api/v1/dashboard.py - Response endpoint
apps/api/app/api/v1/response.py - Websocket endpoint
apps/api/app/api/v1/ws.py
Event Ingestion
- Ingestion service
apps/api/app/ingestion/service.py - Event normalizer
apps/api/app/ingestion/normalizer.py - Outbox publisher
apps/api/app/ingestion/publisher.py - Outbox relay
apps/api/app/streaming/outbox_relay.py - Stream consumer
apps/api/app/streaming/consumer.py - Persistence models
apps/api/app/persistence/models.py
Detection
- Event handler
apps/api/app/streaming/handlers.py - Behavior graph
apps/api/app/insider/graph_store.py - Baseline scorer
apps/api/app/insider/baseline.py - Rate window
apps/api/app/insider/rate_window.py - Isolation forest job
apps/api/app/insider/isolation_forest_job.py
Security and Response
- Alert bus
apps/api/app/streaming/alert_bus.py - Abuse middleware
apps/api/app/middleware/api_abuse_check.py - Abuse detectors
apps/api/app/security/api_abuse.py - Revocation middleware
apps/api/app/middleware/revocation_check.py - Session revocation
apps/api/app/response/session_revoke.py - Websocket tickets
apps/api/app/streaming/ws_auth.py
Other components
- Security operator
- Event producer
- PostgreSQL
- Redis
Connections 36
- Security operator → Security console: uses console
- Event producer → Event endpoint: submits events
- Security console → Event endpoint: submits events
- Security console → Dashboard endpoint: fetches alerts
- Security console → Response endpoint: requests revocation
- FastAPI application → Event endpoint: mounts route
- FastAPI application → Dashboard endpoint: mounts route
- FastAPI application → Response endpoint: mounts route
- FastAPI application → Websocket endpoint: mounts route
- FastAPI application → Abuse middleware: runs checks
- FastAPI application → Revocation middleware: runs checks
- Event endpoint → Ingestion service: ingests event
- Ingestion service → Event normalizer: normalizes event
- Ingestion service → Outbox publisher: publishes outbox
- Outbox publisher → PostgreSQL: writes outbox
- Outbox relay → PostgreSQL: reads outbox
- Outbox relay → Redis: publishes stream
- Stream consumer → Redis: reads stream
- Stream consumer → Event handler: dispatches event
- Event handler → Behavior graph: records access
- Behavior graph → PostgreSQL: reads and writes
- Event handler → Rate window: counts activity
- Rate window → Redis: updates window
- Event handler → Baseline scorer: scores behavior
- Event handler → Alert bus: publishes alert
- Alert bus → Redis: publishes alerts
- Dashboard endpoint → PostgreSQL: reads alerts
- Abuse middleware → Abuse detectors: checks requests
- Abuse detectors → Redis: tracks signals
- Revocation middleware → Session revocation: checks sessions
- Response endpoint → Session revocation: revokes session
- Session revocation → Redis: checks and sets revocation
- Session revocation → PostgreSQL: records revocation
- Websocket endpoint → Websocket tickets: validates ticket
- Websocket tickets → Redis: stores tickets
- Event handler → Isolation forest job: complements scoring