# cpouthier/malware-scan architecture

> Architecture diagram of the GitHub repository cpouthier/malware-scan, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-01). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cpouthier/malware-scan
- Repository: https://github.com/cpouthier/malware-scan

## Overview

Kasten Malware Scan provides a browser-driven and scheduled workflow to validate and scan exported restore points, with an independent Trivy image-vulnerability check. The main app coordinates Kasten operations and ephemeral scanner pods, then records results and streams progress to the browser. Supporting capabilities include persistent scan history, recurring schedules, rules/signature updates, custom YARA rules, registry credentials, email alerts, and licensing. Edges reflect the shown imports and calls or explicit README workflow statements; some implementation details are unsampled, so uncertain connections are omitted.

Main entry points: [`app/main.py`](https://github.com/cpouthier/malware-scan/blob/main/app/main.py) (API and WebSockets), [`app/orchestrator.py`](https://github.com/cpouthier/malware-scan/blob/main/app/orchestrator.py) (Scan orchestration), [`app/alerting.py`](https://github.com/cpouthier/malware-scan/blob/main/app/alerting.py) (Email alerting), [`app/k10.py`](https://github.com/cpouthier/malware-scan/blob/main/app/k10.py) (Kasten operations)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_product["App interface"]
  node_browser["Web UI<br/>[index.html]"]
  node_api["API and WebSockets<br/>[main.py]"]
end

subgraph group_workflow["Scan workflow"]
  node_orchestrator["Scan orchestration<br/>[orchestrator.py]"]
  node_scanner["Malware scanner<br/>[scan.py]"]
  node_image_scan["Image vulnerability scan<br/>[scan.py]"]
end

subgraph group_cache["Rules and data"]
  node_rules_api["Rules management<br/>[rules_cache.py]"]
  node_rule_updater["Signature updater<br/>[update_rules.py]"]
  node_cache_seed["Cache seeding<br/>[seed_cache.py]"]
  node_custom_yara["Custom YARA rules<br/>[custom_rules.py]"]
  node_cache_store[("Shared cache PVC")]
end

subgraph group_operations["Operations"]
  node_scheduler["Recurring schedules<br/>[scheduler.py]"]
  node_history[("Scan history<br/>[orchestrator.py]")]
  node_settings[("App settings<br/>[settings.py]")]
  node_registries[("Registry credentials<br/>[registries.py]")]
  node_alerting["Email alerting<br/>[alerting.py]"]
  node_license["License verification<br/>[license.py]"]
end

subgraph group_integrations["Cluster integrations"]
  node_kasten["Kasten operations<br/>[k10.py]"]
  node_cluster{{"Kubernetes cluster"}}
  node_smtp{{"SMTP service"}}
end

node_user(("Operator"))

node_user -->|"uses"| node_browser
node_browser -->|"requests"| node_api
node_api -->|"starts scans"| node_orchestrator
node_api -->|"manages schedules"| node_scheduler
node_api -->|"manages rules"| node_rules_api
node_api -->|"manages rules"| node_custom_yara
node_api -->|"manages settings"| node_settings
node_api -->|"manages credentials"| node_registries
node_api -->|"checks license"| node_license
node_orchestrator -->|"drives Kasten"| node_kasten
node_orchestrator -->|"runs malware scan"| node_scanner
node_orchestrator -->|"runs image scan"| node_image_scan
node_orchestrator -->|"persists results"| node_history
node_scheduler -->|"triggers scans"| node_orchestrator
node_scheduler -->|"selects restore points"| node_kasten
node_rules_api -->|"starts updates"| node_rule_updater
node_rule_updater -->|"updates cache"| node_cache_store
node_cache_seed -->|"seeds cache"| node_cache_store
node_custom_yara -->|"stores custom rules"| node_cache_store
node_scanner -->|"uses rules cache"| node_cache_store
node_image_scan -.->|"uses credentials"| node_registries
node_alerting -->|"reads alert settings"| node_settings
node_alerting -->|"reads SMTP secret"| node_kasten
node_orchestrator -->|"sends alerts"| node_alerting
node_kasten -->|"operates resources"| node_cluster
node_alerting -->|"sends email"| node_smtp

click node_browser "https://github.com/cpouthier/malware-scan/blob/main/app/static/index.html"
click node_api "https://github.com/cpouthier/malware-scan/blob/main/app/main.py"
click node_orchestrator "https://github.com/cpouthier/malware-scan/blob/main/app/orchestrator.py"
click node_kasten "https://github.com/cpouthier/malware-scan/blob/main/app/k10.py"
click node_scanner "https://github.com/cpouthier/malware-scan/blob/main/scanner/scan.py"
click node_image_scan "https://github.com/cpouthier/malware-scan/blob/main/scanner/scan.py"
click node_scheduler "https://github.com/cpouthier/malware-scan/blob/main/app/scheduler.py"
click node_history "https://github.com/cpouthier/malware-scan/blob/main/app/orchestrator.py"
click node_rules_api "https://github.com/cpouthier/malware-scan/blob/main/app/rules_cache.py"
click node_rule_updater "https://github.com/cpouthier/malware-scan/blob/main/app/update_rules.py"
click node_cache_seed "https://github.com/cpouthier/malware-scan/blob/main/app/seed_cache.py"
click node_custom_yara "https://github.com/cpouthier/malware-scan/blob/main/app/custom_rules.py"
click node_settings "https://github.com/cpouthier/malware-scan/blob/main/app/settings.py"
click node_registries "https://github.com/cpouthier/malware-scan/blob/main/app/registries.py"
click node_alerting "https://github.com/cpouthier/malware-scan/blob/main/app/alerting.py"
click node_license "https://github.com/cpouthier/malware-scan/blob/main/app/license.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_browser,node_api toneBlue
class node_orchestrator,node_scanner,node_image_scan toneAmber
class node_rules_api,node_rule_updater,node_cache_seed,node_custom_yara,node_cache_store toneMint
class node_scheduler,node_history,node_settings,node_registries,node_alerting,node_license toneRose
class node_kasten,node_cluster,node_smtp,node_user toneIndigo
```

## Components

### App interface

- [Web UI](https://github.com/cpouthier/malware-scan/blob/main/app/static/index.html): `app/static/index.html`
- [API and WebSockets](https://github.com/cpouthier/malware-scan/blob/main/app/main.py): `app/main.py`

### Scan workflow

- [Scan orchestration](https://github.com/cpouthier/malware-scan/blob/main/app/orchestrator.py): `app/orchestrator.py`
- [Malware scanner](https://github.com/cpouthier/malware-scan/blob/main/scanner/scan.py): `scanner/scan.py`
- [Image vulnerability scan](https://github.com/cpouthier/malware-scan/blob/main/scanner/scan.py): `scanner/scan.py`

### Rules and data

- [Rules management](https://github.com/cpouthier/malware-scan/blob/main/app/rules_cache.py): `app/rules_cache.py`
- [Signature updater](https://github.com/cpouthier/malware-scan/blob/main/app/update_rules.py): `app/update_rules.py`
- [Cache seeding](https://github.com/cpouthier/malware-scan/blob/main/app/seed_cache.py): `app/seed_cache.py`
- [Custom YARA rules](https://github.com/cpouthier/malware-scan/blob/main/app/custom_rules.py): `app/custom_rules.py`
- **Shared cache PVC**

### Operations

- [Recurring schedules](https://github.com/cpouthier/malware-scan/blob/main/app/scheduler.py): `app/scheduler.py`
- [Scan history](https://github.com/cpouthier/malware-scan/blob/main/app/orchestrator.py): `app/orchestrator.py`
- [App settings](https://github.com/cpouthier/malware-scan/blob/main/app/settings.py): `app/settings.py`
- [Registry credentials](https://github.com/cpouthier/malware-scan/blob/main/app/registries.py): `app/registries.py`
- [Email alerting](https://github.com/cpouthier/malware-scan/blob/main/app/alerting.py): `app/alerting.py`
- [License verification](https://github.com/cpouthier/malware-scan/blob/main/app/license.py): `app/license.py`

### Cluster integrations

- [Kasten operations](https://github.com/cpouthier/malware-scan/blob/main/app/k10.py): `app/k10.py`
- **Kubernetes cluster**
- **SMTP service**

### Other components

- **Operator**

## Connections

- Operator → Web UI: uses (evidence: `README.md`)
- Web UI → API and WebSockets: requests (evidence: `README.md`)
- API and WebSockets → Scan orchestration: starts scans (evidence: `app/main.py`)
- API and WebSockets → Recurring schedules: manages schedules (evidence: `app/main.py`)
- API and WebSockets → Rules management: manages rules (evidence: `app/main.py`)
- API and WebSockets → Custom YARA rules: manages rules (evidence: `app/main.py`)
- API and WebSockets → App settings: manages settings (evidence: `app/main.py`)
- API and WebSockets → Registry credentials: manages credentials (evidence: `app/main.py`)
- API and WebSockets → License verification: checks license (evidence: `app/main.py`)
- Scan orchestration → Kasten operations: drives Kasten (evidence: `app/orchestrator.py`)
- Scan orchestration → Malware scanner: runs malware scan (evidence: `README.md`)
- Scan orchestration → Image vulnerability scan: runs image scan (evidence: `README.md`)
- Scan orchestration → Scan history: persists results (evidence: `app/orchestrator.py`)
- Recurring schedules → Scan orchestration: triggers scans (evidence: `app/scheduler.py`)
- Recurring schedules → Kasten operations: selects restore points (evidence: `app/scheduler.py`)
- Rules management → Signature updater: starts updates (evidence: `app/rules_cache.py`)
- Signature updater → Shared cache PVC: updates cache (evidence: `README.md`)
- Cache seeding → Shared cache PVC: seeds cache (evidence: `README.md`)
- Custom YARA rules → Shared cache PVC: stores custom rules (evidence: `app/custom_rules.py`)
- Malware scanner → Shared cache PVC: uses rules cache (evidence: `README.md`)
- Image vulnerability scan → Registry credentials: uses credentials
- Email alerting → App settings: reads alert settings (evidence: `app/alerting.py`)
- Email alerting → Kasten operations: reads SMTP secret (evidence: `app/alerting.py`)
- Scan orchestration → Email alerting: sends alerts (evidence: `app/alerting.py`)
- Kasten operations → Kubernetes cluster: operates resources (evidence: `README.md`)
- Email alerting → SMTP service: sends email (evidence: `app/alerting.py`)