# cyberrksha/edgerksha architecture

> Architecture diagram of the GitHub repository cyberrksha/edgerksha, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cyberrksha/edgerksha
- Repository: https://github.com/cyberrksha/edgerksha

## Overview

This repository is an edge-focused autonomous SOC research stack: Wazuh collects and alerts on telemetry, perimeter defenses expose attack activity, and AI triage can analyze alerts and trigger guarded response. The clearest live path is the integration triage script, which gathers WAF and honeypot logs and calls the AI analyst; the SOC daemon separately polls Wazuh and can invoke active response. The README also documents phishing analysis, evaluation, integrity checking, benchmarks, and a demo dashboard. Some subsystems are represented by their exact directories because their implementation was not sampled.

Main entry points: [`project-2-soc-bot/src/soc_daemon.py`](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/soc_daemon.py) (SOC Daemon), [`project-2-soc-bot/src/ai_analyst.py`](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/ai_analyst.py) (AI Analyst), [`project-11-integration/triage_live_logs.py`](https://github.com/cyberrksha/edgerksha/blob/master/project-11-integration/triage_live_logs.py) (Live Log Triage), [`project-3-phishing-analyzer/src/app.py`](https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/app.py) (Phishing Analyzer)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_perimeter["Perimeter Defense"]
  node_waf["ModSecurity WAF"]
  node_honeypot["Cowrie Honeypot"]
end

subgraph group_siem["SIEM and Triage"]
  node_wazuh["Wazuh SIEM<br/>[docker-compose.yml]"]
  node_rules["Detection Rules"]
  node_attackparser["Attack Parser<br/>[attack_parser.py]"]
  node_alertparser["Alert Client<br/>[alert_parser.py]"]
  node_daemon["SOC Daemon<br/>[soc_daemon.py]"]
  node_analyst["AI Analyst<br/>[ai_analyst.py]"]
  node_response["Active Response<br/>[active_response.py]"]
  node_reports["Triage Reports<br/>[soc_daemon.py]"]
  node_hashchain["Log Integrity<br/>[hash_chain.py]"]
  node_hallucination["MITRE Audit"]
end

subgraph group_analysis["Analysis Tools"]
  node_phishapp["Phishing Analyzer<br/>[app.py]"]
  node_emailparser["Email Features<br/>[email_parser.py]"]
  node_explainer["AI Explainer<br/>[ai_explainer.py]"]
  node_expaudit["Explainability Audit"]
  node_training["Model Training<br/>[train_models.py]"]
  node_evaluation["SOC Evaluation"]
  node_dataset["Synthetic Alerts<br/>[augment_dataset.py]"]
end

subgraph group_demo["Integration and Demo"]
  node_integration["Live Log Triage"]
  node_killchain["Kill-Chain Demo"]
  node_dashboard["Showcase Dashboard<br/>[app.py]"]
  node_benchmarks["Resource Benchmarks"]
end

node_operator(("Operator"))
node_llm{{"LLM Providers"}}
node_wazuhapi{{"Wazuh API"}}

node_operator -->|"uploads email"| node_phishapp
node_phishapp -->|"extracts features"| node_emailparser
node_phishapp -->|"requests explanation"| node_explainer
node_expaudit -->|"extracts features"| node_emailparser
node_expaudit -->|"explains errors"| node_explainer
node_operator -.->|"runs monitoring"| node_daemon
node_daemon -->|"fetches alerts"| node_alertparser
node_daemon -->|"submits alerts"| node_analyst
node_analyst -->|"queries provider"| node_llm
node_daemon -->|"invokes conditionally"| node_response
node_response -->|"requests firewall drop"| node_wazuhapi
node_daemon -->|"appends results"| node_reports
node_alertparser -->|"queries alerts"| node_wazuhapi
node_rules -.->|"configures detection"| node_wazuh
node_wazuh -.->|"exposes alerts"| node_alertparser
node_integration -->|"reads container logs"| node_waf
node_integration -->|"reads event log"| node_honeypot
node_integration -->|"submits combined alert"| node_analyst
node_operator -->|"runs simulation"| node_killchain
node_operator -->|"launches demo"| node_dashboard
node_operator -->|"runs evaluation"| node_evaluation
node_evaluation -->|"evaluates analyses"| node_analyst
node_evaluation -->|"uses generated alerts"| node_dataset
node_operator -->|"builds integrity chain"| node_hashchain
node_operator -->|"checks MITRE claims"| node_hallucination
node_operator -->|"measures footprint"| node_benchmarks
node_operator -.->|"trains classifier"| node_training

click node_waf "https://github.com/cyberrksha/edgerksha/tree/master/project-4-waf"
click node_honeypot "https://github.com/cyberrksha/edgerksha/tree/master/project-5-honeypot"
click node_wazuh "https://github.com/cyberrksha/edgerksha/blob/master/project-1-siem/docker/docker-compose.yml"
click node_rules "https://github.com/cyberrksha/edgerksha/tree/master/project-1-siem/wazuh_rules"
click node_attackparser "https://github.com/cyberrksha/edgerksha/blob/master/project-1-siem/src/attack_parser.py"
click node_alertparser "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/alert_parser.py"
click node_daemon "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/soc_daemon.py"
click node_analyst "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/ai_analyst.py"
click node_response "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/active_response.py"
click node_reports "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/soc_daemon.py"
click node_hashchain "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/hash_chain.py"
click node_hallucination "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/hallucination_checker.py"
click node_phishapp "https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/app.py"
click node_emailparser "https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/email_parser.py"
click node_explainer "https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/ai_explainer.py"
click node_expaudit "https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/explainability_audit.py"
click node_training "https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/train_models.py"
click node_evaluation "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/evaluation_harness.py"
click node_dataset "https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/augment_dataset.py"
click node_integration "https://github.com/cyberrksha/edgerksha/blob/master/project-11-integration/triage_live_logs.py"
click node_killchain "https://github.com/cyberrksha/edgerksha/blob/master/project-11-integration/simulate_killchain.py"
click node_dashboard "https://github.com/cyberrksha/edgerksha/blob/master/project-12-showcase/app.py"
click node_benchmarks "https://github.com/cyberrksha/edgerksha/tree/master/project-6-benchmarks/src"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_waf,node_honeypot toneBlue
class node_wazuh,node_rules,node_attackparser,node_alertparser,node_daemon,node_analyst,node_response,node_reports,node_hashchain,node_hallucination toneAmber
class node_phishapp,node_emailparser,node_explainer,node_expaudit,node_training,node_evaluation,node_dataset,node_wazuhapi toneMint
class node_integration,node_killchain,node_dashboard,node_benchmarks toneRose
class node_operator,node_llm toneIndigo
```

## Components

### Perimeter Defense

- [ModSecurity WAF](https://github.com/cyberrksha/edgerksha/tree/master/project-4-waf): `project-4-waf`
- [Cowrie Honeypot](https://github.com/cyberrksha/edgerksha/tree/master/project-5-honeypot): `project-5-honeypot`

### SIEM and Triage

- [Wazuh SIEM](https://github.com/cyberrksha/edgerksha/blob/master/project-1-siem/docker/docker-compose.yml): `project-1-siem/docker/docker-compose.yml`
- [Detection Rules](https://github.com/cyberrksha/edgerksha/tree/master/project-1-siem/wazuh_rules): `project-1-siem/wazuh_rules`
- [Attack Parser](https://github.com/cyberrksha/edgerksha/blob/master/project-1-siem/src/attack_parser.py): `project-1-siem/src/attack_parser.py`
- [Alert Client](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/alert_parser.py): `project-2-soc-bot/src/alert_parser.py`
- [SOC Daemon](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/soc_daemon.py): `project-2-soc-bot/src/soc_daemon.py`
- [AI Analyst](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/ai_analyst.py): `project-2-soc-bot/src/ai_analyst.py`
- [Active Response](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/active_response.py): `project-2-soc-bot/src/active_response.py`
- [Triage Reports](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/soc_daemon.py): `project-2-soc-bot/src/soc_daemon.py`
- [Log Integrity](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/hash_chain.py): `project-2-soc-bot/src/hash_chain.py`
- [MITRE Audit](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/hallucination_checker.py): `project-2-soc-bot/src/hallucination_checker.py`

### Analysis Tools

- [Phishing Analyzer](https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/app.py): `project-3-phishing-analyzer/src/app.py`
- [Email Features](https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/email_parser.py): `project-3-phishing-analyzer/src/email_parser.py`
- [AI Explainer](https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/ai_explainer.py): `project-3-phishing-analyzer/src/ai_explainer.py`
- [Explainability Audit](https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/explainability_audit.py): `project-3-phishing-analyzer/src/explainability_audit.py`
- [Model Training](https://github.com/cyberrksha/edgerksha/blob/master/project-3-phishing-analyzer/src/train_models.py): `project-3-phishing-analyzer/src/train_models.py`
- [SOC Evaluation](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/evaluation_harness.py): `project-2-soc-bot/src/evaluation_harness.py`
- [Synthetic Alerts](https://github.com/cyberrksha/edgerksha/blob/master/project-2-soc-bot/src/augment_dataset.py): `project-2-soc-bot/src/augment_dataset.py`

### Integration and Demo

- [Live Log Triage](https://github.com/cyberrksha/edgerksha/blob/master/project-11-integration/triage_live_logs.py): `project-11-integration/triage_live_logs.py`
- [Kill-Chain Demo](https://github.com/cyberrksha/edgerksha/blob/master/project-11-integration/simulate_killchain.py): `project-11-integration/simulate_killchain.py`
- [Showcase Dashboard](https://github.com/cyberrksha/edgerksha/blob/master/project-12-showcase/app.py): `project-12-showcase/app.py`
- [Resource Benchmarks](https://github.com/cyberrksha/edgerksha/tree/master/project-6-benchmarks/src): `project-6-benchmarks/src`

### Other components

- **Operator**
- **LLM Providers**
- **Wazuh API**

## Connections

- Operator → Phishing Analyzer: uploads email (evidence: `project-3-phishing-analyzer/src/app.py`)
- Phishing Analyzer → Email Features: extracts features (evidence: `project-3-phishing-analyzer/src/app.py`)
- Phishing Analyzer → AI Explainer: requests explanation (evidence: `project-3-phishing-analyzer/src/app.py`)
- Explainability Audit → Email Features: extracts features (evidence: `project-3-phishing-analyzer/src/explainability_audit.py`)
- Explainability Audit → AI Explainer: explains errors (evidence: `project-3-phishing-analyzer/src/explainability_audit.py`)
- Operator → SOC Daemon: runs monitoring (evidence: `README.md`)
- SOC Daemon → Alert Client: fetches alerts (evidence: `project-2-soc-bot/src/soc_daemon.py`)
- SOC Daemon → AI Analyst: submits alerts (evidence: `project-2-soc-bot/src/soc_daemon.py`)
- AI Analyst → LLM Providers: queries provider (evidence: `project-2-soc-bot/src/ai_analyst.py`)
- SOC Daemon → Active Response: invokes conditionally (evidence: `project-2-soc-bot/src/soc_daemon.py`)
- Active Response → Wazuh API: requests firewall drop (evidence: `project-2-soc-bot/src/active_response.py`)
- SOC Daemon → Triage Reports: appends results (evidence: `project-2-soc-bot/src/soc_daemon.py`)
- Alert Client → Wazuh API: queries alerts (evidence: `project-2-soc-bot/src/alert_parser.py`)
- Detection Rules → Wazuh SIEM: configures detection (evidence: `README.md`)
- Wazuh SIEM → Alert Client: exposes alerts (evidence: `README.md`)
- Live Log Triage → ModSecurity WAF: reads container logs (evidence: `project-11-integration/triage_live_logs.py`)
- Live Log Triage → Cowrie Honeypot: reads event log (evidence: `project-11-integration/triage_live_logs.py`)
- Live Log Triage → AI Analyst: submits combined alert (evidence: `project-11-integration/triage_live_logs.py`)
- Operator → Kill-Chain Demo: runs simulation (evidence: `README.md`)
- Operator → Showcase Dashboard: launches demo (evidence: `README.md`)
- Operator → SOC Evaluation: runs evaluation (evidence: `README.md`)
- SOC Evaluation → AI Analyst: evaluates analyses (evidence: `project-2-soc-bot/src/evaluation_harness.py`)
- SOC Evaluation → Synthetic Alerts: uses generated alerts (evidence: `project-2-soc-bot/src/evaluation_harness.py`)
- Operator → Log Integrity: builds integrity chain (evidence: `README.md`)
- Operator → MITRE Audit: checks MITRE claims (evidence: `README.md`)
- Operator → Resource Benchmarks: measures footprint (evidence: `README.md`)
- Operator → Model Training: trains classifier