# csquirrel84/proj_orochi architecture

> Architecture diagram of the GitHub repository csquirrel84/proj_orochi, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/csquirrel84/proj_orochi
- Repository: https://github.com/csquirrel84/proj_orochi

## Overview

Orochi appears to be an Ansible-based deployment project for a network monitoring and incident-response environment. The visible playbook names suggest workflows for preparing artefacts, setting up a management box, deploying remote capture, and checking updates. The roles cover the monitoring stack and supporting services. Only the Suricata source-fetcher implementation was sampled, so links between playbooks and roles are not asserted; the README content provided no additional capability details.

Main entry points: [`orochi/files/fetch_suricata_sources.py`](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/files/fetch_suricata_sources.py) (Fetch Suricata Rules), [`orochi/playbooks/prep_artefacts.yml`](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/prep_artefacts.yml) (Prepare Artefacts), [`orochi/playbooks/check_updates.yml`](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/check_updates.yml) (Check Updates), [`orochi/playbooks/setup_mgmt_box.yml`](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/setup_mgmt_box.yml) (Setup Management)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_workflows["Operator Workflows"]
  node_prep["Prepare Artefacts<br/>[prep_artefacts.yml]"]
  node_setup["Setup Management<br/>[setup_mgmt_box.yml]"]
  node_deploy["Deploy Capture"]
  node_updates["Check Updates<br/>[check_updates.yml]"]
end

subgraph group_capture["Network Monitoring"]
  node_fetch["Fetch Suricata Rules"]
  node_suricata["Suricata<br/>[main.yml]"]
  node_zeek["Zeek<br/>[main.yml]"]
  node_velociraptor["Velociraptor<br/>[main.yml]"]
  node_arkime["Arkime<br/>[main.yml]"]
end

subgraph group_analysis["Investigation Services"]
  node_rita["RITA<br/>[main.yml]"]
  node_timesketch["Timesketch<br/>[main.yml]"]
  node_thehive["TheHive<br/>[main.yml]"]
  node_cyberchef["CyberChef<br/>[main.yml]"]
end

subgraph group_platform["Platform Services"]
  node_elastic["Elasticsearch<br/>[main.yml]"]
  node_kibana["Kibana<br/>[main.yml]"]
  node_fleet["Fleet<br/>[main.yml]"]
  node_mattermost["Mattermost<br/>[main.yml]"]
  node_nginx["Nginx Proxy<br/>[main.yml]"]
end

node_operator(("Operator"))
node_rules["Rule Artefacts"]
node_sources(("Free Rule Sources"))

node_operator -->|"runs"| node_prep
node_operator -->|"runs"| node_setup
node_operator -->|"runs"| node_deploy
node_operator -->|"runs"| node_updates
node_prep -->|"invokes"| node_fetch
node_updates -->|"invokes"| node_fetch
node_fetch -->|"downloads"| node_sources
node_fetch -->|"writes"| node_rules

click node_prep "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/prep_artefacts.yml"
click node_setup "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/setup_mgmt_box.yml"
click node_deploy "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/deploy_remote_capture.yml"
click node_updates "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/check_updates.yml"
click node_fetch "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/files/fetch_suricata_sources.py"
click node_suricata "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/suricata/tasks/main.yml"
click node_zeek "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/zeek/tasks/main.yml"
click node_velociraptor "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/velociraptor/tasks/main.yml"
click node_arkime "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/arkime/tasks/main.yml"
click node_rita "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/rita/tasks/main.yml"
click node_timesketch "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/timesketch/tasks/main.yml"
click node_thehive "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/thehive/tasks/main.yml"
click node_cyberchef "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/cyberchef/tasks/main.yml"
click node_elastic "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/elasticsearch/tasks/main.yml"
click node_kibana "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/kibana/tasks/main.yml"
click node_fleet "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/fleet/tasks/main.yml"
click node_mattermost "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/mattermost/tasks/main.yml"
click node_nginx "https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/nginx_proxy/tasks/main.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_prep,node_setup,node_deploy,node_updates toneBlue
class node_fetch,node_suricata,node_zeek,node_velociraptor,node_arkime toneAmber
class node_rita,node_timesketch,node_thehive,node_cyberchef toneMint
class node_elastic,node_kibana,node_fleet,node_mattermost,node_nginx toneRose
class node_operator,node_rules,node_sources toneIndigo
```

## Components

### Operator Workflows

- [Prepare Artefacts](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/prep_artefacts.yml): `orochi/playbooks/prep_artefacts.yml`
- [Setup Management](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/setup_mgmt_box.yml): `orochi/playbooks/setup_mgmt_box.yml`
- [Deploy Capture](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/deploy_remote_capture.yml): `orochi/playbooks/deploy_remote_capture.yml`
- [Check Updates](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/playbooks/check_updates.yml): `orochi/playbooks/check_updates.yml`

### Network Monitoring

- [Fetch Suricata Rules](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/files/fetch_suricata_sources.py): `orochi/files/fetch_suricata_sources.py`
- [Suricata](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/suricata/tasks/main.yml): `orochi/roles/suricata/tasks/main.yml`
- [Zeek](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/zeek/tasks/main.yml): `orochi/roles/zeek/tasks/main.yml`
- [Velociraptor](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/velociraptor/tasks/main.yml): `orochi/roles/velociraptor/tasks/main.yml`
- [Arkime](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/arkime/tasks/main.yml): `orochi/roles/arkime/tasks/main.yml`

### Investigation Services

- [RITA](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/rita/tasks/main.yml): `orochi/roles/rita/tasks/main.yml`
- [Timesketch](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/timesketch/tasks/main.yml): `orochi/roles/timesketch/tasks/main.yml`
- [TheHive](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/thehive/tasks/main.yml): `orochi/roles/thehive/tasks/main.yml`
- [CyberChef](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/cyberchef/tasks/main.yml): `orochi/roles/cyberchef/tasks/main.yml`

### Platform Services

- [Elasticsearch](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/elasticsearch/tasks/main.yml): `orochi/roles/elasticsearch/tasks/main.yml`
- [Kibana](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/kibana/tasks/main.yml): `orochi/roles/kibana/tasks/main.yml`
- [Fleet](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/fleet/tasks/main.yml): `orochi/roles/fleet/tasks/main.yml`
- [Mattermost](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/mattermost/tasks/main.yml): `orochi/roles/mattermost/tasks/main.yml`
- [Nginx Proxy](https://github.com/csquirrel84/proj_orochi/blob/main/orochi/roles/nginx_proxy/tasks/main.yml): `orochi/roles/nginx_proxy/tasks/main.yml`

### Other components

- **Operator**
- **Rule Artefacts**
- **Free Rule Sources**

## Connections

- Operator → Prepare Artefacts: runs
- Operator → Setup Management: runs
- Operator → Deploy Capture: runs
- Operator → Check Updates: runs
- Prepare Artefacts → Fetch Suricata Rules: invokes
- Check Updates → Fetch Suricata Rules: invokes
- Fetch Suricata Rules → Free Rule Sources: downloads
- Fetch Suricata Rules → Rule Artefacts: writes