# best-geek/identifirelease architecture

> Architecture diagram of the GitHub repository best-geek/identifirelease, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/best-geek/identifirelease
- Repository: https://github.com/best-geek/identifirelease
- Video tour (about a minute): https://gitdiagram.com/best-geek/identifirelease/video

## Overview

Identifi detects anomalous Microsoft 365 login behavior: audit activity is read from Elasticsearch, converted into login history and behavioral features, learned per-user models score recent activity, and explainable detections are made available for investigation through the web UI and API. Analysts can inspect users and detections, tune and simulate suppression rules, and configure integrations; administrators also manage users, access, and system settings. The README documents webhook alerting, audit logging, and investigative assistance. Some backend modules are represented from the tree and README only; their internal wiring is not asserted here.

Main entry points: [`python/api_server.py`](https://github.com/best-geek/identifirelease/blob/main/python/api_server.py) (API server), [`python/detection_pipeline.py`](https://github.com/best-geek/identifirelease/blob/main/python/detection_pipeline.py) (Detection pipeline), [`indentifi_ui/src/router.js`](https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/router.js) (UI routes), [`python/document_to_redis.py`](https://github.com/best-geek/identifirelease/blob/main/python/document_to_redis.py) (Ingestion runner)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingest["Ingestion and features"]
  node_ingest_runner["Ingestion runner"]
  node_source["Log source adapter<br/>[data_source.py]"]
  node_features["Login features"]
end

subgraph group_detect["Modeling and detection"]
  node_training["Model training<br/>[login_model_run.py]"]
  node_models["User models<br/>[login_model.py]"]
  node_pipeline["Detection pipeline"]
  node_rules["Rule evaluation"]
end

subgraph group_access["API and administration"]
  node_api["API server<br/>[api_server.py]"]
  node_auth["Authentication and roles<br/>[authentication.py]"]
  node_limiter["API rate limiting"]
  node_settings["System settings<br/>[SettingsView.vue]"]
end

subgraph group_investigate["Investigation and tuning"]
  node_ui["Identifi web UI<br/>[App.vue]"]
  node_routes["UI routes<br/>[router.js]"]
  node_detection_view["Detection investigation"]
  node_user_view["User investigation<br/>[UserDetails.vue]"]
  node_suppression["Suppression tuning<br/>[SuppresionRule.vue]"]
  node_chat["Investigative assistance"]
end

subgraph group_integrations["Storage and integrations"]
  node_es[("Elasticsearch")]
  node_redis[("Redis history")]
  node_mongo[("MongoDB")]
  node_webhook["User webhooks"]
  node_audit["Audit log<br/>[db_logger.py]"]
end

node_m365(("Microsoft 365"))
node_analyst(("Analyst or admin"))

node_m365 -->|"sends audit logs"| node_es
node_es -->|"queries log data"| node_source
node_ingest_runner -->|"reads source"| node_source
node_ingest_runner -->|"derives features"| node_features
node_ingest_runner -->|"stores login history"| node_redis
node_redis -->|"provides history"| node_training
node_training -->|"trains models"| node_models
node_redis -->|"provides recent logins"| node_pipeline
node_pipeline -->|"scores activity"| node_models
node_pipeline -->|"evaluates suppression"| node_rules
node_pipeline -->|"stores detections"| node_mongo
node_pipeline -.->|"sends alerts"| node_webhook
node_analyst -->|"uses"| node_ui
node_ui -->|"navigates"| node_routes
node_ui -->|"requests data"| node_api
node_api -->|"checks credentials"| node_auth
node_api -->|"limits requests"| node_limiter
node_api -->|"reads and writes"| node_mongo
node_api -->|"reads and writes"| node_redis
node_routes -->|"routes detections"| node_detection_view
node_routes -->|"routes users"| node_user_view
node_routes -->|"routes rule editing"| node_suppression
node_routes -->|"routes settings"| node_settings
node_detection_view -->|"requests details"| node_api
node_user_view -->|"requests activity"| node_api
node_suppression -->|"saves rules"| node_api
node_settings -->|"configures system"| node_api
node_pipeline -->|"records events"| node_audit
node_chat -.->|"assists investigations"| node_api

click node_ingest_runner "https://github.com/best-geek/identifirelease/blob/main/python/document_to_redis.py"
click node_source "https://github.com/best-geek/identifirelease/blob/main/python/data_source.py"
click node_features "https://github.com/best-geek/identifirelease/blob/main/python/user_agent_classifier.py"
click node_training "https://github.com/best-geek/identifirelease/blob/main/python/login_model_run.py"
click node_models "https://github.com/best-geek/identifirelease/blob/main/python/login_model.py"
click node_pipeline "https://github.com/best-geek/identifirelease/blob/main/python/detection_pipeline.py"
click node_rules "https://github.com/best-geek/identifirelease/blob/main/python/semantic_rule_engine.py"
click node_api "https://github.com/best-geek/identifirelease/blob/main/python/api_server.py"
click node_auth "https://github.com/best-geek/identifirelease/blob/main/python/authentication.py"
click node_limiter "https://github.com/best-geek/identifirelease/blob/main/python/api_rate_limiter.py"
click node_ui "https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/App.vue"
click node_routes "https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/router.js"
click node_detection_view "https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/components/DetectionDetail.vue"
click node_user_view "https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/components/UserDetails.vue"
click node_suppression "https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/components/SuppresionRule.vue"
click node_settings "https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/components/SettingsView.vue"
click node_chat "https://github.com/best-geek/identifirelease/blob/main/python/ai_inference/identifi_chat_skills.py"
click node_audit "https://github.com/best-geek/identifirelease/blob/main/python/db_logger.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ingest_runner,node_source,node_features toneBlue
class node_training,node_models,node_pipeline,node_rules toneAmber
class node_api,node_auth,node_limiter,node_settings toneMint
class node_ui,node_routes,node_detection_view,node_user_view,node_suppression,node_chat toneRose
class node_es,node_redis,node_mongo,node_webhook,node_audit,node_m365,node_analyst toneIndigo
```

## Components

### Ingestion and features

- [Ingestion runner](https://github.com/best-geek/identifirelease/blob/main/python/document_to_redis.py): `python/document_to_redis.py`
- [Log source adapter](https://github.com/best-geek/identifirelease/blob/main/python/data_source.py): `python/data_source.py`
- [Login features](https://github.com/best-geek/identifirelease/blob/main/python/user_agent_classifier.py): `python/user_agent_classifier.py`

### Modeling and detection

- [Model training](https://github.com/best-geek/identifirelease/blob/main/python/login_model_run.py): `python/login_model_run.py`
- [User models](https://github.com/best-geek/identifirelease/blob/main/python/login_model.py): `python/login_model.py`
- [Detection pipeline](https://github.com/best-geek/identifirelease/blob/main/python/detection_pipeline.py): `python/detection_pipeline.py`
- [Rule evaluation](https://github.com/best-geek/identifirelease/blob/main/python/semantic_rule_engine.py): `python/semantic_rule_engine.py`

### API and administration

- [API server](https://github.com/best-geek/identifirelease/blob/main/python/api_server.py): `python/api_server.py`
- [Authentication and roles](https://github.com/best-geek/identifirelease/blob/main/python/authentication.py): `python/authentication.py`
- [API rate limiting](https://github.com/best-geek/identifirelease/blob/main/python/api_rate_limiter.py): `python/api_rate_limiter.py`
- [System settings](https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/components/SettingsView.vue): `indentifi_ui/src/components/SettingsView.vue`

### Investigation and tuning

- [Identifi web UI](https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/App.vue): `indentifi_ui/src/App.vue`
- [UI routes](https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/router.js): `indentifi_ui/src/router.js`
- [Detection investigation](https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/components/DetectionDetail.vue): `indentifi_ui/src/components/DetectionDetail.vue`
- [User investigation](https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/components/UserDetails.vue): `indentifi_ui/src/components/UserDetails.vue`
- [Suppression tuning](https://github.com/best-geek/identifirelease/blob/main/indentifi_ui/src/components/SuppresionRule.vue): `indentifi_ui/src/components/SuppresionRule.vue`
- [Investigative assistance](https://github.com/best-geek/identifirelease/blob/main/python/ai_inference/identifi_chat_skills.py): `python/ai_inference/identifi_chat_skills.py`

### Storage and integrations

- **Elasticsearch**
- **Redis history**
- **MongoDB**
- **User webhooks**
- [Audit log](https://github.com/best-geek/identifirelease/blob/main/python/db_logger.py): `python/db_logger.py`

### Other components

- **Microsoft 365**
- **Analyst or admin**

## Connections

- Microsoft 365 → Elasticsearch: sends audit logs
- Elasticsearch → Log source adapter: queries log data
- Ingestion runner → Log source adapter: reads source
- Ingestion runner → Login features: derives features
- Ingestion runner → Redis history: stores login history
- Redis history → Model training: provides history
- Model training → User models: trains models
- Redis history → Detection pipeline: provides recent logins
- Detection pipeline → User models: scores activity
- Detection pipeline → Rule evaluation: evaluates suppression
- Detection pipeline → MongoDB: stores detections
- Detection pipeline → User webhooks: sends alerts
- Analyst or admin → Identifi web UI: uses
- Identifi web UI → UI routes: navigates
- Identifi web UI → API server: requests data
- API server → Authentication and roles: checks credentials
- API server → API rate limiting: limits requests
- API server → MongoDB: reads and writes
- API server → Redis history: reads and writes
- UI routes → Detection investigation: routes detections
- UI routes → User investigation: routes users
- UI routes → Suppression tuning: routes rule editing
- UI routes → System settings: routes settings
- Detection investigation → API server: requests details
- User investigation → API server: requests activity
- Suppression tuning → API server: saves rules
- System settings → API server: configures system
- Detection pipeline → Audit log: records events
- Investigative assistance → API server: assists investigations