# baichuan-di/winlog-insight architecture

> Architecture diagram of the GitHub repository baichuan-di/winlog-insight, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/baichuan-di/winlog-insight
- Repository: https://github.com/baichuan-di/winlog-insight

## Overview

WinLog Insight is a local Windows security-log analysis desktop tool. Its documented workflow is to scan Application, Security, and System logs, apply built-in security rules to identify threats, and present risk levels and a security score; users can also monitor incoming logs for alerts and export audit reports. Custom rules extend analysis. The README describes these capabilities but no source code or file tree beyond README.md was provided, so component paths and relationships below reflect documentation only. AI analysis is described as a planned capability.

Main entry points: [`README.md`](https://github.com/baichuan-di/winlog-insight/blob/main/README.md) (Log scanner)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_analysis["Log analysis"]
  node_scanner["Log scanner<br/>[README.md]"]
  node_eventlogs[("Windows event logs")]
  node_ruleengine["Security rules<br/>[README.md]"]
  node_threats["Threat findings<br/>[README.md]"]
end

subgraph group_response["Risk response"]
  node_monitor["Live monitor<br/>[README.md]"]
  node_alerts["Security alerts<br/>[README.md]"]
  node_dashboard["Risk dashboard<br/>[README.md]"]
  node_riskview["Risk summary<br/>[README.md]"]
end

subgraph group_audit["Audit and rules"]
  node_reporter["Report export<br/>[README.md]"]
  node_reports["Audit reports<br/>[README.md]"]
  node_customrules["Custom rules<br/>[README.md]"]
end

subgraph group_future["Planned AI"]
  node_ai["AI analysis<br/>[README.md]"]
  node_llm{{"External LLM"}}
end

node_user(("User"))

node_user -->|"starts scan"| node_scanner
node_scanner -->|"reads logs"| node_eventlogs
node_scanner -->|"analyzes logs"| node_ruleengine
node_ruleengine -->|"identifies threats"| node_threats
node_user -->|"starts monitoring"| node_monitor
node_monitor -->|"watches stream"| node_eventlogs
node_monitor -->|"raises alerts"| node_alerts
node_user -->|"views dashboard"| node_dashboard
node_dashboard -->|"shows distribution"| node_riskview
node_user -->|"exports report"| node_reporter
node_reporter -->|"generates reports"| node_reports
node_user -->|"defines rules"| node_customrules
node_customrules -->|"extends rules"| node_ruleengine
node_user -.->|"requests analysis"| node_ai
node_ai -.->|"calls model"| node_llm

click node_scanner "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_ruleengine "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_threats "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_monitor "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_alerts "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_dashboard "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_riskview "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_reporter "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_reports "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_customrules "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"
click node_ai "https://github.com/baichuan-di/winlog-insight/blob/main/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_scanner,node_eventlogs,node_ruleengine,node_threats,node_user toneBlue
class node_monitor,node_alerts,node_dashboard,node_riskview toneAmber
class node_reporter,node_reports,node_customrules toneMint
class node_ai,node_llm toneRose
```

## Components

### Log analysis

- [Log scanner](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`
- **Windows event logs**
- [Security rules](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`
- [Threat findings](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`

### Risk response

- [Live monitor](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`
- [Security alerts](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`
- [Risk dashboard](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`
- [Risk summary](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`

### Audit and rules

- [Report export](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`
- [Audit reports](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`
- [Custom rules](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`

### Planned AI

- [AI analysis](https://github.com/baichuan-di/winlog-insight/blob/main/README.md): `README.md`
- **External LLM**

### Other components

- **User**

## Connections

- User → Log scanner: starts scan (evidence: `README.md`)
- Log scanner → Windows event logs: reads logs (evidence: `README.md`)
- Log scanner → Security rules: analyzes logs (evidence: `README.md`)
- Security rules → Threat findings: identifies threats (evidence: `README.md`)
- User → Live monitor: starts monitoring (evidence: `README.md`)
- Live monitor → Windows event logs: watches stream (evidence: `README.md`)
- Live monitor → Security alerts: raises alerts (evidence: `README.md`)
- User → Risk dashboard: views dashboard (evidence: `README.md`)
- Risk dashboard → Risk summary: shows distribution (evidence: `README.md`)
- User → Report export: exports report (evidence: `README.md`)
- Report export → Audit reports: generates reports (evidence: `README.md`)
- User → Custom rules: defines rules (evidence: `README.md`)
- Custom rules → Security rules: extends rules (evidence: `README.md`)
- User → AI analysis: requests analysis (evidence: `README.md`)
- AI analysis → External LLM: calls model (evidence: `README.md`)