# cisagov/lme architecture

> Architecture diagram of the GitHub repository cisagov/lme, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cisagov/lme
- Repository: https://github.com/cisagov/lme
- Video tour (about a minute): https://gitdiagram.com/cisagov/lme/video

## Overview

Logging Made Easy (LME) is a self-hosted logging, threat-detection, and alerting platform aimed at smaller organizations. The main workflow is administrator deployment, endpoint log collection, centralized indexing and detection, then alert review in dashboards. Ansible and Podman provide an internal deployment layer; Wazuh, Elastic, Kibana, and ElastAlert form the security-monitoring stack. The repository also includes an AI-enabled dashboard and documentation RAG ingestion, plus optional Caldera threat emulation. The README documents the overall capabilities; some subsystem links below reflect documented integration rather than inspected implementation.

Main entry points: [`ansible/roles/elasticsearch/tasks/main.yml`](https://github.com/cisagov/lme/blob/main/ansible/roles/elasticsearch/tasks/main.yml) (Elasticsearch), [`ansible/site.yml`](https://github.com/cisagov/lme/blob/main/ansible/site.yml) (Ansible Playbooks), [`ansible/roles/ludus_lme_agents/tasks/main.yml`](https://github.com/cisagov/lme/blob/main/ansible/roles/ludus_lme_agents/tasks/main.yml) (Endpoint Agents), [`quadlet/lme-litellm.container`](https://github.com/cisagov/lme/blob/main/quadlet/lme-litellm.container) (LiteLLM Proxy)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_deploy["Deployment"]
  node_ansible["Ansible Playbooks<br/>[site.yml]"]
  node_base["Host Preparation<br/>[main.yml]"]
  node_podman["Podman Setup<br/>[main.yml]"]
  node_quadlet["Container Services"]
end

subgraph group_monitor["Security Monitoring"]
  node_agents["Endpoint Agents<br/>[main.yml]"]
  node_wazuh["Wazuh Manager<br/>[main.yml]"]
  node_elastic[("Elasticsearch<br/>[main.yml]")]
  node_fleet["Elastic Fleet<br/>[main.yml]"]
  node_elastalert["ElastAlert"]
end

subgraph group_interface["Dashboards and AI"]
  node_kibana["Kibana<br/>[main.yml]"]
  node_dashboards["Security Dashboards"]
  node_lme_ui["LME Dashboard API<br/>[app.py]"]
  node_log_analyzer["Alert Analyzer<br/>[app_simple.py]"]
  node_litellm["LiteLLM Proxy"]
end

subgraph group_enrichment["Enrichment and Emulation"]
  node_doc_ingest["Docs Ingestion<br/>[ingest_docs.py]"]
  node_embeddings["Embedding Service"]
  node_pgvector[("Documentation Vector Store")]
  node_caldera["Caldera Emulation<br/>[main.yml]"]
end

node_admin(("Administrator"))
node_endpoints(("Network Endpoints"))
node_llm(("LLM Provider"))

node_admin -->|"runs deployment"| node_ansible
node_ansible -->|"configures host"| node_base
node_ansible -->|"sets up containers"| node_podman
node_podman -->|"runs services"| node_quadlet
node_endpoints -->|"generate logs"| node_agents
node_agents -->|"send telemetry"| node_wazuh
node_agents -->|"send telemetry"| node_fleet
node_wazuh -->|"index events"| node_elastic
node_fleet -->|"manage collection"| node_elastic
node_elastic -->|"provide indexed events"| node_elastalert
node_elastic -->|"serve searches"| node_kibana
node_kibana -->|"display monitoring"| node_dashboards
node_elastic -->|"query alerts"| node_lme_ui
node_elastic -->|"query alerts"| node_log_analyzer
node_lme_ui -.->|"request analysis"| node_litellm
node_log_analyzer -.->|"request analysis"| node_litellm
node_litellm -.->|"dispatch prompts"| node_llm
node_doc_ingest -.->|"request vectors"| node_embeddings
node_doc_ingest -.->|"store chunks"| node_pgvector
node_admin -.->|"run emulation"| node_caldera

click node_ansible "https://github.com/cisagov/lme/blob/main/ansible/site.yml"
click node_base "https://github.com/cisagov/lme/blob/main/ansible/roles/base/tasks/main.yml"
click node_podman "https://github.com/cisagov/lme/blob/main/ansible/roles/podman/tasks/main.yml"
click node_quadlet "https://github.com/cisagov/lme/tree/main/quadlet"
click node_agents "https://github.com/cisagov/lme/blob/main/ansible/roles/ludus_lme_agents/tasks/main.yml"
click node_wazuh "https://github.com/cisagov/lme/blob/main/ansible/roles/wazuh/tasks/main.yml"
click node_elastic "https://github.com/cisagov/lme/blob/main/ansible/roles/elasticsearch/tasks/main.yml"
click node_fleet "https://github.com/cisagov/lme/blob/main/ansible/roles/fleet/tasks/main.yml"
click node_elastalert "https://github.com/cisagov/lme/tree/main/config/elastalert2"
click node_kibana "https://github.com/cisagov/lme/blob/main/ansible/roles/kibana/tasks/main.yml"
click node_dashboards "https://github.com/cisagov/lme/tree/main/dashboards/elastic"
click node_lme_ui "https://github.com/cisagov/lme/blob/main/lme-dashboard/app.py"
click node_log_analyzer "https://github.com/cisagov/lme/blob/main/lme-log-analyzer/app_simple.py"
click node_litellm "https://github.com/cisagov/lme/blob/main/quadlet/lme-litellm.container"
click node_doc_ingest "https://github.com/cisagov/lme/blob/main/scripts/ingest_docs.py"
click node_embeddings "https://github.com/cisagov/lme/blob/main/quadlet/lme-embeddings.container"
click node_pgvector "https://github.com/cisagov/lme/blob/main/quadlet/lme-pgvector.container"
click node_caldera "https://github.com/cisagov/lme/blob/main/ansible/roles/ludus_caldera_server/tasks/main.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ansible,node_base,node_podman,node_quadlet toneBlue
class node_agents,node_wazuh,node_elastic,node_fleet,node_elastalert toneAmber
class node_kibana,node_dashboards,node_lme_ui,node_log_analyzer,node_litellm toneMint
class node_doc_ingest,node_embeddings,node_pgvector,node_caldera toneRose
class node_admin,node_endpoints,node_llm toneIndigo
```

## Components

### Deployment

- [Ansible Playbooks](https://github.com/cisagov/lme/blob/main/ansible/site.yml): `ansible/site.yml`
- [Host Preparation](https://github.com/cisagov/lme/blob/main/ansible/roles/base/tasks/main.yml): `ansible/roles/base/tasks/main.yml`
- [Podman Setup](https://github.com/cisagov/lme/blob/main/ansible/roles/podman/tasks/main.yml): `ansible/roles/podman/tasks/main.yml`
- [Container Services](https://github.com/cisagov/lme/tree/main/quadlet): `quadlet`

### Security Monitoring

- [Endpoint Agents](https://github.com/cisagov/lme/blob/main/ansible/roles/ludus_lme_agents/tasks/main.yml): `ansible/roles/ludus_lme_agents/tasks/main.yml`
- [Wazuh Manager](https://github.com/cisagov/lme/blob/main/ansible/roles/wazuh/tasks/main.yml): `ansible/roles/wazuh/tasks/main.yml`
- [Elasticsearch](https://github.com/cisagov/lme/blob/main/ansible/roles/elasticsearch/tasks/main.yml): `ansible/roles/elasticsearch/tasks/main.yml`
- [Elastic Fleet](https://github.com/cisagov/lme/blob/main/ansible/roles/fleet/tasks/main.yml): `ansible/roles/fleet/tasks/main.yml`
- [ElastAlert](https://github.com/cisagov/lme/tree/main/config/elastalert2): `config/elastalert2`

### Dashboards and AI

- [Kibana](https://github.com/cisagov/lme/blob/main/ansible/roles/kibana/tasks/main.yml): `ansible/roles/kibana/tasks/main.yml`
- [Security Dashboards](https://github.com/cisagov/lme/tree/main/dashboards/elastic): `dashboards/elastic`
- [LME Dashboard API](https://github.com/cisagov/lme/blob/main/lme-dashboard/app.py): `lme-dashboard/app.py`
- [Alert Analyzer](https://github.com/cisagov/lme/blob/main/lme-log-analyzer/app_simple.py): `lme-log-analyzer/app_simple.py`
- [LiteLLM Proxy](https://github.com/cisagov/lme/blob/main/quadlet/lme-litellm.container): `quadlet/lme-litellm.container`

### Enrichment and Emulation

- [Docs Ingestion](https://github.com/cisagov/lme/blob/main/scripts/ingest_docs.py): `scripts/ingest_docs.py`
- [Embedding Service](https://github.com/cisagov/lme/blob/main/quadlet/lme-embeddings.container): `quadlet/lme-embeddings.container`
- [Documentation Vector Store](https://github.com/cisagov/lme/blob/main/quadlet/lme-pgvector.container): `quadlet/lme-pgvector.container`
- [Caldera Emulation](https://github.com/cisagov/lme/blob/main/ansible/roles/ludus_caldera_server/tasks/main.yml): `ansible/roles/ludus_caldera_server/tasks/main.yml`

### Other components

- **Administrator**
- **Network Endpoints**
- **LLM Provider**

## Connections

- Administrator → Ansible Playbooks: runs deployment
- Ansible Playbooks → Host Preparation: configures host
- Ansible Playbooks → Podman Setup: sets up containers
- Podman Setup → Container Services: runs services
- Network Endpoints → Endpoint Agents: generate logs
- Endpoint Agents → Wazuh Manager: send telemetry
- Endpoint Agents → Elastic Fleet: send telemetry
- Wazuh Manager → Elasticsearch: index events
- Elastic Fleet → Elasticsearch: manage collection
- Elasticsearch → ElastAlert: provide indexed events
- Elasticsearch → Kibana: serve searches
- Kibana → Security Dashboards: display monitoring
- Elasticsearch → LME Dashboard API: query alerts
- Elasticsearch → Alert Analyzer: query alerts
- LME Dashboard API → LiteLLM Proxy: request analysis
- Alert Analyzer → LiteLLM Proxy: request analysis
- LiteLLM Proxy → LLM Provider: dispatch prompts
- Docs Ingestion → Embedding Service: request vectors
- Docs Ingestion → Documentation Vector Store: store chunks
- Administrator → Caldera Emulation: run emulation