# balaajraza/techfusion-hackathon architecture

> Architecture diagram of the GitHub repository balaajraza/techfusion-hackathon, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/balaajraza/techfusion-hackathon
- Repository: https://github.com/balaajraza/techfusion-hackathon

## Overview

Orbit SOC Triage turns raw security logs and company reference files into a cited, verified incident case file, then exposes triage and evidence review through a web app. The backend workflow ingests and classifies inputs, parses events with normalized times, resolves entities and references, detects incidents, filters approved maintenance noise, assembles evidence and response guidance, and produces a report. Model-written prose is optional and gated by verification; structured-fact Q&A is another capability. Source excerpts and the README support the main pipeline; UI-to-API wiring and several unsampled subsystem details are not fully shown.

Main entry points: [`backend/app/pipeline/run.py`](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/run.py) (Pipeline coordinator), [`backend/app/llm/prose.py`](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/llm/prose.py) (Grounded prose), [`frontend/src/app/page.tsx`](https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/app/page.tsx) (Triage workspace), [`backend/app/llm/gateway.py`](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/llm/gateway.py) (LLM gateway)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["SOC web workspace"]
  node_workspace["Triage workspace<br/>[page.tsx]"]
  node_incident_views["Incident dossier<br/>[dossier.tsx]"]
  node_evidence_view["Evidence inspector<br/>[evidence.tsx]"]
  node_assistant_ui["SOC copilot<br/>[assistant.tsx]"]
  node_api_client["API client<br/>[api.ts]"]
end

subgraph group_api["Backend API"]
  node_api_server["API server<br/>[main.py]"]
  node_case_store[("Case persistence<br/>[db.py]")]
end

subgraph group_pipeline["Triage pipeline"]
  node_case_models["Case data model<br/>[models.py]"]
  node_ingest["Input ingestion<br/>[ingest.py]"]
  node_parsers["Log parsers<br/>[parsers.py]"]
  node_time["Time normalization<br/>[timeutil.py]"]
  node_entities["Entity resolution<br/>[entities.py]"]
  node_references["Reference tables<br/>[references.py]"]
  node_detectors["Incident detection<br/>[detectors.py]"]
  node_noise["Maintenance filtering<br/>[noise.py]"]
  node_runner["Pipeline coordinator<br/>[run.py]"]
end

subgraph group_evidence["Evidence and response"]
  node_ledger["Evidence ledger<br/>[assemble.py]"]
  node_response["Actions and escalation<br/>[response.py]"]
  node_report["Case report<br/>[report.py]"]
  node_qa["Evidence Q&amp;A<br/>[qa.py]"]
end

subgraph group_language["Language and security"]
  node_gateway["LLM gateway<br/>[gateway.py]"]
  node_prose["Grounded prose<br/>[prose.py]"]
  node_verifier["Claim verifier<br/>[verifier.py]"]
  node_injection["Injection defense<br/>[injection.py]"]
  node_integrity["Evidence integrity<br/>[integrity.py]"]
  node_pseudonymize["Pseudonymization<br/>[pseudonymize.py]"]
end

node_analyst(("SOC analyst"))
node_local_llm["Local Ollama"]
node_cloud_llm["Cloud model endpoint"]

node_analyst -.->|"reviews cases"| node_workspace
node_workspace -.->|"shows dossier"| node_incident_views
node_workspace -.->|"opens citations"| node_evidence_view
node_workspace -.->|"asks questions"| node_assistant_ui
node_workspace -.->|"uses API"| node_api_client
node_api_client -.->|"sends requests"| node_api_server
node_api_server -->|"runs triage"| node_runner
node_api_server -->|"answers questions"| node_qa
node_api_server -->|"persists cases"| node_case_store
node_runner -->|"ingests inputs"| node_ingest
node_runner -->|"parses events"| node_parsers
node_parsers -->|"normalizes timestamps"| node_time
node_runner -->|"resolves entities"| node_entities
node_runner -->|"loads references"| node_references
node_runner -->|"detects activity"| node_detectors
node_runner -->|"filters maintenance"| node_noise
node_runner -->|"builds evidence"| node_ledger
node_runner -->|"builds response"| node_response
node_runner -->|"creates report"| node_report
node_runner -->|"checks integrity"| node_integrity
node_runner -->|"requests prose"| node_gateway
node_runner -->|"phrases claims"| node_prose
node_prose -->|"requests completion"| node_gateway
node_prose -->|"verifies sentences"| node_verifier
node_prose -->|"sandboxes evidence"| node_injection
node_prose -->|"masks identities"| node_pseudonymize
node_gateway -->|"calls local model"| node_local_llm
node_gateway -->|"calls cloud model"| node_cloud_llm
node_qa -->|"may request prose"| node_gateway
node_qa -->|"phrases answer"| node_prose
node_qa -.->|"checks answer"| node_verifier

click node_workspace "https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/app/page.tsx"
click node_incident_views "https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/components/dossier.tsx"
click node_evidence_view "https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/components/evidence.tsx"
click node_assistant_ui "https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/components/assistant.tsx"
click node_api_client "https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/lib/api.ts"
click node_api_server "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/main.py"
click node_case_store "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/db.py"
click node_case_models "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/models.py"
click node_ingest "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/ingest.py"
click node_parsers "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/parsers.py"
click node_time "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/timeutil.py"
click node_entities "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/entities.py"
click node_references "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/references.py"
click node_detectors "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/detectors.py"
click node_noise "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/noise.py"
click node_runner "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/run.py"
click node_ledger "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/assemble.py"
click node_response "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/response.py"
click node_report "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/report.py"
click node_qa "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/qa.py"
click node_gateway "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/llm/gateway.py"
click node_prose "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/llm/prose.py"
click node_verifier "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/verifier.py"
click node_injection "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/security/injection.py"
click node_integrity "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/security/integrity.py"
click node_pseudonymize "https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/security/pseudonymize.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_workspace,node_incident_views,node_evidence_view,node_assistant_ui,node_api_client toneBlue
class node_api_server,node_case_store toneAmber
class node_case_models,node_ingest,node_parsers,node_time,node_entities,node_references,node_detectors,node_noise,node_runner toneMint
class node_ledger,node_response,node_report,node_qa toneRose
class node_gateway,node_prose,node_verifier,node_injection,node_integrity,node_pseudonymize,node_analyst,node_local_llm,node_cloud_llm toneIndigo
```

## Components

### SOC web workspace

- [Triage workspace](https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/app/page.tsx): `frontend/src/app/page.tsx`
- [Incident dossier](https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/components/dossier.tsx): `frontend/src/components/dossier.tsx`
- [Evidence inspector](https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/components/evidence.tsx): `frontend/src/components/evidence.tsx`
- [SOC copilot](https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/components/assistant.tsx): `frontend/src/components/assistant.tsx`
- [API client](https://github.com/balaajraza/techfusion-hackathon/blob/main/frontend/src/lib/api.ts): `frontend/src/lib/api.ts`

### Backend API

- [API server](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/main.py): `backend/app/main.py`
- [Case persistence](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/db.py): `backend/app/db.py`

### Triage pipeline

- [Case data model](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/models.py): `backend/app/models.py`
- [Input ingestion](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/ingest.py): `backend/app/pipeline/ingest.py`
- [Log parsers](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/parsers.py): `backend/app/pipeline/parsers.py`
- [Time normalization](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/timeutil.py): `backend/app/pipeline/timeutil.py`
- [Entity resolution](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/entities.py): `backend/app/pipeline/entities.py`
- [Reference tables](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/references.py): `backend/app/pipeline/references.py`
- [Incident detection](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/detectors.py): `backend/app/pipeline/detectors.py`
- [Maintenance filtering](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/noise.py): `backend/app/pipeline/noise.py`
- [Pipeline coordinator](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/run.py): `backend/app/pipeline/run.py`

### Evidence and response

- [Evidence ledger](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/assemble.py): `backend/app/pipeline/assemble.py`
- [Actions and escalation](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/response.py): `backend/app/pipeline/response.py`
- [Case report](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/report.py): `backend/app/pipeline/report.py`
- [Evidence Q&A](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/qa.py): `backend/app/qa.py`

### Language and security

- [LLM gateway](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/llm/gateway.py): `backend/app/llm/gateway.py`
- [Grounded prose](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/llm/prose.py): `backend/app/llm/prose.py`
- [Claim verifier](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/pipeline/verifier.py): `backend/app/pipeline/verifier.py`
- [Injection defense](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/security/injection.py): `backend/app/security/injection.py`
- [Evidence integrity](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/security/integrity.py): `backend/app/security/integrity.py`
- [Pseudonymization](https://github.com/balaajraza/techfusion-hackathon/blob/main/backend/app/security/pseudonymize.py): `backend/app/security/pseudonymize.py`

### Other components

- **SOC analyst**
- **Local Ollama**
- **Cloud model endpoint**

## Connections

- SOC analyst → Triage workspace: reviews cases
- Triage workspace → Incident dossier: shows dossier
- Triage workspace → Evidence inspector: opens citations
- Triage workspace → SOC copilot: asks questions
- Triage workspace → API client: uses API
- API client → API server: sends requests
- API server → Pipeline coordinator: runs triage (evidence: `backend/app/main.py`)
- API server → Evidence Q&A: answers questions (evidence: `backend/app/main.py`)
- API server → Case persistence: persists cases (evidence: `backend/app/main.py`)
- Pipeline coordinator → Input ingestion: ingests inputs (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Log parsers: parses events (evidence: `backend/app/pipeline/run.py`)
- Log parsers → Time normalization: normalizes timestamps (evidence: `backend/app/pipeline/parsers.py`)
- Pipeline coordinator → Entity resolution: resolves entities (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Reference tables: loads references (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Incident detection: detects activity (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Maintenance filtering: filters maintenance (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Evidence ledger: builds evidence (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Actions and escalation: builds response (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Case report: creates report (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Evidence integrity: checks integrity (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → LLM gateway: requests prose (evidence: `backend/app/pipeline/run.py`)
- Pipeline coordinator → Grounded prose: phrases claims (evidence: `backend/app/pipeline/run.py`)
- Grounded prose → LLM gateway: requests completion (evidence: `backend/app/llm/prose.py`)
- Grounded prose → Claim verifier: verifies sentences (evidence: `backend/app/llm/prose.py`)
- Grounded prose → Injection defense: sandboxes evidence (evidence: `backend/app/llm/prose.py`)
- Grounded prose → Pseudonymization: masks identities (evidence: `backend/app/llm/prose.py`)
- LLM gateway → Local Ollama: calls local model (evidence: `backend/app/llm/gateway.py`)
- LLM gateway → Cloud model endpoint: calls cloud model (evidence: `backend/app/llm/gateway.py`)
- Evidence Q&A → LLM gateway: may request prose (evidence: `backend/app/qa.py`)
- Evidence Q&A → Grounded prose: phrases answer (evidence: `backend/app/qa.py`)
- Evidence Q&A → Claim verifier: checks answer