# danthit333-oss/maa architecture

> Architecture diagram of the GitHub repository danthit333-oss/maa, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/danthit333-oss/maa
- Repository: https://github.com/danthit333-oss/maa

## Overview

This is a multi-part Web honeypot and attack-analysis platform. Its principal workflow captures contained web or network activity, ingests events through the API, stores and summarizes them, and presents them in the dashboard; SIEM correlation and exports extend that flow. The README also documents model training, IDS normalization, hardening, deployment, and evaluation. Several of those implementations were not excerpted, so their documented capabilities are shown with README-supported relationships rather than inferred internal calls.

Main entry points: [`part_03_API_LOGGING/app/main.py`](https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/main.py) (Ingestion API), [`part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py`](https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py) (Live IDS Sensor), [`part_01_AI_ML/src/models/train.py`](https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/models/train.py) (XGBoost Training), [`part_02_WEB_HONEYPOT/honeypot/routes.py`](https://github.com/danthit333-oss/maa/blob/main/part_02_WEB_HONEYPOT/honeypot/routes.py) (Web Honeypot)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_sensors["Honeypot and Sensors"]
  node_honeypot["Web Honeypot<br/>[routes.py]"]
  node_honeypot_db[("Lure Observations<br/>[db.py]")]
  node_ids_sensor["Live IDS Sensor<br/>[live_sensor.py]"]
  node_flow_features["Flow Features<br/>[flow_features.py]"]
  node_collector["IDS Collector<br/>[collector.py]"]
  node_normalizers["Event Normalizers<br/>[normalizers.py]"]
end

subgraph group_ingest["API and Storage"]
  node_api["Ingestion API<br/>[main.py]"]
  node_event_routes["Event Routes<br/>[events.py]"]
  node_event_services["Dedup and Queries<br/>[services.py]"]
  node_event_models["Event Models<br/>[models.py]"]
  node_event_db[("PostgreSQL Store<br/>[database.py]")]
  node_stats["Stats API<br/>[stats.py]"]
end

subgraph group_analysis["Detection and SIEM"]
  node_ml_training["XGBoost Training<br/>[train.py]"]
  node_data_cleaner["Data Cleaning<br/>[cleaner.py]"]
  node_labels["Attack Labels<br/>[labels.py]"]
  node_ml_reports["Model Reports<br/>[reporting.py]"]
  node_predictor["XGBoost Predictor<br/>[predictor.py]"]
  node_siem["SIEM Correlation<br/>[correlation.py]"]
  node_siem_io["SIEM HTTP and Export<br/>[io.py]"]
  node_elastic[("Elasticsearch")]
end

subgraph group_ui["Dashboard"]
  node_dashboard["SOC Dashboard<br/>[App.jsx]"]
  node_dashboard_api["Dashboard API Client<br/>[api.js]"]
  node_event_drawer["Event Detail View<br/>[EventDrawer.jsx]"]
  node_icon["Dashboard Icons<br/>[Icon.jsx]"]
end

subgraph group_ops["Security and Evaluation"]
  node_hardening["Security Hardening"]
  node_deployment["Stack Deployment"]
  node_evaluation["Scenario Evaluation"]
end

node_client(("HTTP / SSH Clients"))

node_client -->|"sends requests"| node_honeypot
node_client -->|"generates traffic"| node_ids_sensor
node_honeypot -->|"records observations"| node_honeypot_db
node_honeypot -->|"forwards events"| node_api
node_ids_sensor -->|"extracts features"| node_flow_features
node_ids_sensor -->|"submits flows"| node_collector
node_collector -->|"normalizes input"| node_normalizers
node_ids_sensor -->|"predicts threats"| node_predictor
node_ids_sensor -->|"posts alerts"| node_api
node_ml_training -->|"prepares data"| node_data_cleaner
node_ml_training -->|"encodes classes"| node_labels
node_ml_training -->|"writes reports"| node_ml_reports
node_ml_training -.->|"supplies model"| node_predictor
node_api -->|"registers routes"| node_event_routes
node_api -->|"registers routes"| node_stats
node_event_routes -->|"deduplicates events"| node_event_services
node_event_routes -->|"uses sessions"| node_event_db
node_event_services -->|"creates events"| node_event_models
node_event_db -.->|"persists records"| node_event_models
node_stats -->|"queries summaries"| node_event_db
node_dashboard -->|"loads data"| node_dashboard_api
node_dashboard_api -.->|"requests summaries"| node_stats
node_dashboard_api -.->|"requests events"| node_event_routes
node_dashboard -->|"renders details"| node_event_drawer
node_event_drawer -->|"uses icons"| node_icon
node_api -->|"provides events"| node_siem
node_siem -.->|"uses HTTP helpers"| node_siem_io
node_siem_io -->|"reads and posts"| node_api
node_siem_io -->|"bulk exports"| node_elastic
node_hardening -->|"isolates lure plane"| node_honeypot
node_deployment -->|"deploys stack"| node_api
node_deployment -->|"deploys stack"| node_dashboard
node_evaluation -.->|"evaluates ingestion"| node_api

click node_honeypot "https://github.com/danthit333-oss/maa/blob/main/part_02_WEB_HONEYPOT/honeypot/routes.py"
click node_honeypot_db "https://github.com/danthit333-oss/maa/blob/main/part_02_WEB_HONEYPOT/honeypot/db.py"
click node_ids_sensor "https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py"
click node_flow_features "https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/flow_features.py"
click node_collector "https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/collector.py"
click node_normalizers "https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/normalizers.py"
click node_api "https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/main.py"
click node_event_routes "https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/routers/events.py"
click node_event_services "https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/services.py"
click node_event_models "https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/models.py"
click node_event_db "https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/database.py"
click node_stats "https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/routers/stats.py"
click node_dashboard "https://github.com/danthit333-oss/maa/blob/main/part_04_DASHBOARD_ANALYTICS/src/App.jsx"
click node_dashboard_api "https://github.com/danthit333-oss/maa/blob/main/part_04_DASHBOARD_ANALYTICS/src/api.js"
click node_event_drawer "https://github.com/danthit333-oss/maa/blob/main/part_04_DASHBOARD_ANALYTICS/src/components/EventDrawer.jsx"
click node_icon "https://github.com/danthit333-oss/maa/blob/main/part_04_DASHBOARD_ANALYTICS/src/components/Icon.jsx"
click node_ml_training "https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/models/train.py"
click node_data_cleaner "https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/data/cleaner.py"
click node_labels "https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/data/labels.py"
click node_ml_reports "https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/reporting.py"
click node_predictor "https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/predictor.py"
click node_siem "https://github.com/danthit333-oss/maa/blob/main/part_06_SIEM_ALERTING/siem/correlation.py"
click node_siem_io "https://github.com/danthit333-oss/maa/blob/main/part_06_SIEM_ALERTING/siem/io.py"
click node_hardening "https://github.com/danthit333-oss/maa/tree/main/part_07_SECURITY_HARDENING"
click node_deployment "https://github.com/danthit333-oss/maa/tree/main/part_08_DOCKER_DEPLOYMENT"
click node_evaluation "https://github.com/danthit333-oss/maa/tree/main/part_09_TEST_REPORT/evaluation"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_honeypot,node_honeypot_db,node_ids_sensor,node_flow_features,node_collector,node_normalizers,node_client toneBlue
class node_api,node_event_routes,node_event_services,node_event_models,node_event_db,node_stats toneAmber
class node_ml_training,node_data_cleaner,node_labels,node_ml_reports,node_predictor,node_siem,node_siem_io,node_elastic toneMint
class node_dashboard,node_dashboard_api,node_event_drawer,node_icon toneRose
class node_hardening,node_deployment,node_evaluation toneIndigo
```

## Components

### Honeypot and Sensors

- [Web Honeypot](https://github.com/danthit333-oss/maa/blob/main/part_02_WEB_HONEYPOT/honeypot/routes.py): `part_02_WEB_HONEYPOT/honeypot/routes.py`
- [Lure Observations](https://github.com/danthit333-oss/maa/blob/main/part_02_WEB_HONEYPOT/honeypot/db.py): `part_02_WEB_HONEYPOT/honeypot/db.py`
- [Live IDS Sensor](https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py): `part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py`
- [Flow Features](https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/flow_features.py): `part_05_IDS_ML_DETECTION/ids_bridge/flow_features.py`
- [IDS Collector](https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/collector.py): `part_05_IDS_ML_DETECTION/ids_bridge/collector.py`
- [Event Normalizers](https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/normalizers.py): `part_05_IDS_ML_DETECTION/ids_bridge/normalizers.py`

### API and Storage

- [Ingestion API](https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/main.py): `part_03_API_LOGGING/app/main.py`
- [Event Routes](https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/routers/events.py): `part_03_API_LOGGING/app/routers/events.py`
- [Dedup and Queries](https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/services.py): `part_03_API_LOGGING/app/services.py`
- [Event Models](https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/models.py): `part_03_API_LOGGING/app/models.py`
- [PostgreSQL Store](https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/database.py): `part_03_API_LOGGING/app/database.py`
- [Stats API](https://github.com/danthit333-oss/maa/blob/main/part_03_API_LOGGING/app/routers/stats.py): `part_03_API_LOGGING/app/routers/stats.py`

### Detection and SIEM

- [XGBoost Training](https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/models/train.py): `part_01_AI_ML/src/models/train.py`
- [Data Cleaning](https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/data/cleaner.py): `part_01_AI_ML/src/data/cleaner.py`
- [Attack Labels](https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/data/labels.py): `part_01_AI_ML/src/data/labels.py`
- [Model Reports](https://github.com/danthit333-oss/maa/blob/main/part_01_AI_ML/src/reporting.py): `part_01_AI_ML/src/reporting.py`
- [XGBoost Predictor](https://github.com/danthit333-oss/maa/blob/main/part_05_IDS_ML_DETECTION/ids_bridge/predictor.py): `part_05_IDS_ML_DETECTION/ids_bridge/predictor.py`
- [SIEM Correlation](https://github.com/danthit333-oss/maa/blob/main/part_06_SIEM_ALERTING/siem/correlation.py): `part_06_SIEM_ALERTING/siem/correlation.py`
- [SIEM HTTP and Export](https://github.com/danthit333-oss/maa/blob/main/part_06_SIEM_ALERTING/siem/io.py): `part_06_SIEM_ALERTING/siem/io.py`
- **Elasticsearch**

### Dashboard

- [SOC Dashboard](https://github.com/danthit333-oss/maa/blob/main/part_04_DASHBOARD_ANALYTICS/src/App.jsx): `part_04_DASHBOARD_ANALYTICS/src/App.jsx`
- [Dashboard API Client](https://github.com/danthit333-oss/maa/blob/main/part_04_DASHBOARD_ANALYTICS/src/api.js): `part_04_DASHBOARD_ANALYTICS/src/api.js`
- [Event Detail View](https://github.com/danthit333-oss/maa/blob/main/part_04_DASHBOARD_ANALYTICS/src/components/EventDrawer.jsx): `part_04_DASHBOARD_ANALYTICS/src/components/EventDrawer.jsx`
- [Dashboard Icons](https://github.com/danthit333-oss/maa/blob/main/part_04_DASHBOARD_ANALYTICS/src/components/Icon.jsx): `part_04_DASHBOARD_ANALYTICS/src/components/Icon.jsx`

### Security and Evaluation

- [Security Hardening](https://github.com/danthit333-oss/maa/tree/main/part_07_SECURITY_HARDENING): `part_07_SECURITY_HARDENING`
- [Stack Deployment](https://github.com/danthit333-oss/maa/tree/main/part_08_DOCKER_DEPLOYMENT): `part_08_DOCKER_DEPLOYMENT`
- [Scenario Evaluation](https://github.com/danthit333-oss/maa/tree/main/part_09_TEST_REPORT/evaluation): `part_09_TEST_REPORT/evaluation`

### Other components

- **HTTP / SSH Clients**

## Connections

- HTTP / SSH Clients → Web Honeypot: sends requests (evidence: `README.md`)
- HTTP / SSH Clients → Live IDS Sensor: generates traffic (evidence: `README.md`)
- Web Honeypot → Lure Observations: records observations (evidence: `part_02_WEB_HONEYPOT/honeypot/routes.py`)
- Web Honeypot → Ingestion API: forwards events (evidence: `README.md`)
- Live IDS Sensor → Flow Features: extracts features (evidence: `part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py`)
- Live IDS Sensor → IDS Collector: submits flows (evidence: `part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py`)
- IDS Collector → Event Normalizers: normalizes input (evidence: `part_05_IDS_ML_DETECTION/ids_bridge/collector.py`)
- Live IDS Sensor → XGBoost Predictor: predicts threats (evidence: `part_05_IDS_ML_DETECTION/ids_bridge/live_sensor.py`)
- Live IDS Sensor → Ingestion API: posts alerts (evidence: `README.md`)
- XGBoost Training → Data Cleaning: prepares data (evidence: `part_01_AI_ML/src/models/train.py`)
- XGBoost Training → Attack Labels: encodes classes (evidence: `part_01_AI_ML/src/models/train.py`)
- XGBoost Training → Model Reports: writes reports (evidence: `part_01_AI_ML/src/models/train.py`)
- XGBoost Training → XGBoost Predictor: supplies model
- Ingestion API → Event Routes: registers routes (evidence: `part_03_API_LOGGING/app/main.py`)
- Ingestion API → Stats API: registers routes (evidence: `part_03_API_LOGGING/app/main.py`)
- Event Routes → Dedup and Queries: deduplicates events (evidence: `part_03_API_LOGGING/app/routers/events.py`)
- Event Routes → PostgreSQL Store: uses sessions (evidence: `part_03_API_LOGGING/app/routers/events.py`)
- Dedup and Queries → Event Models: creates events (evidence: `part_03_API_LOGGING/app/services.py`)
- PostgreSQL Store → Event Models: persists records
- Stats API → PostgreSQL Store: queries summaries (evidence: `part_03_API_LOGGING/app/routers/stats.py`)
- SOC Dashboard → Dashboard API Client: loads data (evidence: `part_04_DASHBOARD_ANALYTICS/src/App.jsx`)
- Dashboard API Client → Stats API: requests summaries
- Dashboard API Client → Event Routes: requests events
- SOC Dashboard → Event Detail View: renders details (evidence: `part_04_DASHBOARD_ANALYTICS/src/App.jsx`)
- Event Detail View → Dashboard Icons: uses icons (evidence: `part_04_DASHBOARD_ANALYTICS/src/components/EventDrawer.jsx`)
- Ingestion API → SIEM Correlation: provides events (evidence: `README.md`)
- SIEM Correlation → SIEM HTTP and Export: uses HTTP helpers
- SIEM HTTP and Export → Ingestion API: reads and posts (evidence: `part_06_SIEM_ALERTING/siem/io.py`)
- SIEM HTTP and Export → Elasticsearch: bulk exports (evidence: `part_06_SIEM_ALERTING/siem/io.py`)
- Security Hardening → Web Honeypot: isolates lure plane (evidence: `README.md`)
- Stack Deployment → Ingestion API: deploys stack (evidence: `README.md`)
- Stack Deployment → SOC Dashboard: deploys stack (evidence: `README.md`)
- Scenario Evaluation → Ingestion API: evaluates ingestion