How danthit333-oss/maa works
This is a multi-part Web honeypot and attack-analysis platform. Its principal workflow captures contained web or network activity, ingests events through the API, stores and summarizes them, and presents them in the dashboard; SIEM correlation and exports extend that flow. The README also documents model training, IDS normalization, hardening, deployment, and evaluation. Several of those implementations were not excerpted, so their documented capabilities are shown with README-supported relationships rather than inferred internal calls.
Main entry points: main.py Ingestion API · live_sensor.py Live IDS Sensor · train.py XGBoost Training · routes.py Web Honeypot
Components 28
Honeypot and Sensors
- Web Honeypot
part_02_WEB_HONEYPOT/honeypot/routes.py - Lure Observations
part_02_WEB_HONEYPOT/honeypot/db.py - Live IDS Sensor
part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py - Flow Features
part_05_IDS_ML_DETECTION/ids_bridge/flow_features.py - IDS Collector
part_05_IDS_ML_DETECTION/ids_bridge/collector.py - Event Normalizers
part_05_IDS_ML_DETECTION/ids_bridge/normalizers.py
API and Storage
- Ingestion API
part_03_API_LOGGING/app/main.py - Event Routes
part_03_API_LOGGING/app/routers/events.py - Dedup and Queries
part_03_API_LOGGING/app/services.py - Event Models
part_03_API_LOGGING/app/models.py - PostgreSQL Store
part_03_API_LOGGING/app/database.py - Stats API
part_03_API_LOGGING/app/routers/stats.py
Detection and SIEM
- XGBoost Training
part_01_AI_ML/src/models/train.py - Data Cleaning
part_01_AI_ML/src/data/cleaner.py - Attack Labels
part_01_AI_ML/src/data/labels.py - Model Reports
part_01_AI_ML/src/reporting.py - XGBoost Predictor
part_05_IDS_ML_DETECTION/ids_bridge/predictor.py - SIEM Correlation
part_06_SIEM_ALERTING/siem/correlation.py - SIEM HTTP and Export
part_06_SIEM_ALERTING/siem/io.py - Elasticsearch
Dashboard
- SOC Dashboard
part_04_DASHBOARD_ANALYTICS/src/App.jsx - Dashboard API Client
part_04_DASHBOARD_ANALYTICS/src/api.js - Event Detail View
part_04_DASHBOARD_ANALYTICS/src/components/EventDrawer.jsx - Dashboard Icons
part_04_DASHBOARD_ANALYTICS/src/components/Icon.jsx
Security and Evaluation
- Security Hardening
part_07_SECURITY_HARDENING - Stack Deployment
part_08_DOCKER_DEPLOYMENT - Scenario Evaluation
part_09_TEST_REPORT/evaluation
Other components
- HTTP / SSH Clients
Connections 33
- HTTP / SSH Clients → Web Honeypot: sends requests
README.md - HTTP / SSH Clients → Live IDS Sensor: generates traffic
README.md - Web Honeypot → Lure Observations: records observations
part_02_WEB_HONEYPOT/honeypot/routes.py - Web Honeypot → Ingestion API: forwards events
README.md - Live IDS Sensor → Flow Features: extracts features
part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py - Live IDS Sensor → IDS Collector: submits flows
part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py - IDS Collector → Event Normalizers: normalizes input
part_05_IDS_ML_DETECTION/ids_bridge/collector.py - Live IDS Sensor → XGBoost Predictor: predicts threats
part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py - Live IDS Sensor → Ingestion API: posts alerts
README.md - XGBoost Training → Data Cleaning: prepares data
part_01_AI_ML/src/models/train.py - XGBoost Training → Attack Labels: encodes classes
part_01_AI_ML/src/models/train.py - XGBoost Training → Model Reports: writes reports
part_01_AI_ML/src/models/train.py - XGBoost Training → XGBoost Predictor: supplies model
- Ingestion API → Event Routes: registers routes
part_03_API_LOGGING/app/main.py - Ingestion API → Stats API: registers routes
part_03_API_LOGGING/app/main.py - Event Routes → Dedup and Queries: deduplicates events
part_03_API_LOGGING/app/routers/events.py - Event Routes → PostgreSQL Store: uses sessions
part_03_API_LOGGING/app/routers/events.py - Dedup and Queries → Event Models: creates events
part_03_API_LOGGING/app/services.py - PostgreSQL Store → Event Models: persists records
- Stats API → PostgreSQL Store: queries summaries
part_03_API_LOGGING/app/routers/stats.py - SOC Dashboard → Dashboard API Client: loads data
part_04_DASHBOARD_ANALYTICS/src/App.jsx - Dashboard API Client → Stats API: requests summaries
- Dashboard API Client → Event Routes: requests events
- SOC Dashboard → Event Detail View: renders details
part_04_DASHBOARD_ANALYTICS/src/App.jsx - Event Detail View → Dashboard Icons: uses icons
part_04_DASHBOARD_ANALYTICS/src/components/EventDrawer.jsx - Ingestion API → SIEM Correlation: provides events
README.md - SIEM Correlation → SIEM HTTP and Export: uses HTTP helpers
- SIEM HTTP and Export → Ingestion API: reads and posts
part_06_SIEM_ALERTING/siem/io.py - SIEM HTTP and Export → Elasticsearch: bulk exports
part_06_SIEM_ALERTING/siem/io.py - Security Hardening → Web Honeypot: isolates lure plane
README.md - Stack Deployment → Ingestion API: deploys stack
README.md - Stack Deployment → SOC Dashboard: deploys stack
README.md - Scenario Evaluation → Ingestion API: evaluates ingestion