# deathbydata/oneshot-secops architecture

> Architecture diagram of the GitHub repository deathbydata/oneshot-secops, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/deathbydata/oneshot-secops
- Repository: https://github.com/deathbydata/oneshot-secops

## Overview

oneshot-secops is a pair of offline, single-file browser tools for first-look analysis of firewall and web access logs. An analyst opens the relevant HTML file, loads logs, reviews parsed events and triage leads, then exports a filtered CSV or case summary. The README documents the capabilities and this workflow, but the HTML source was not sampled, so internal implementation details and finer-grained call relationships cannot be verified. Both tools keep analysis in the browser and make no network requests.

Main entry points: [`fortigate-log-triage.html`](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html) (FortiGate tool), [`web-log-triage.html`](https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html) (Web log tool)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_shared["Shared triage capabilities"]
  node_loading["Load and hash files"]
  node_parsing["Detect and parse formats"]
  node_timeline["Timeline and filters"]
  node_events["Events table"]
  node_sources["Source cards"]
  node_topvalues["Top values"]
  node_exports["CSV and case summary"]
end

subgraph group_fortigate["FortiGate triage"]
  node_fgtool["FortiGate tool"]
  node_fgformats["FortiGate formats"]
  node_fgcontext["Device context"]
  node_fgleads["Firewall leads"]
  node_matrix["Communication matrix"]
end

subgraph group_web["Web access triage"]
  node_webtool["Web log tool"]
  node_webformats["Web log formats"]
  node_urlchecks["URL pattern checks"]
  node_webleads["Web leads"]
  node_conversations["Conversations"]
end

node_analyst(("Security analyst"))

node_analyst -->|"opens and analyzes"| node_fgtool
node_analyst -->|"opens and analyzes"| node_webtool
node_fgtool -->|"loads files"| node_loading
node_webtool -->|"loads files"| node_loading
node_fgtool -->|"detects and parses"| node_parsing
node_webtool -->|"detects and parses"| node_parsing
node_fgtool -->|"reads"| node_fgformats
node_webtool -->|"reads"| node_webformats
node_fgtool -->|"provides"| node_timeline
node_webtool -->|"provides"| node_timeline
node_fgtool -->|"presents"| node_events
node_webtool -->|"presents"| node_events
node_fgtool -->|"provides"| node_sources
node_webtool -->|"provides"| node_sources
node_fgtool -->|"summarizes"| node_topvalues
node_webtool -->|"summarizes"| node_topvalues
node_fgtool -->|"identifies devices"| node_fgcontext
node_fgtool -->|"raises heuristic leads"| node_fgleads
node_fgtool -->|"summarizes flows"| node_matrix
node_webtool -->|"checks decoded URLs"| node_urlchecks
node_webtool -->|"raises heuristic leads"| node_webleads
node_webtool -->|"groups requests"| node_conversations
node_fgtool -->|"exports findings"| node_exports
node_webtool -->|"exports findings"| node_exports

click node_fgtool "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_webtool "https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html"
click node_loading "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_parsing "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_timeline "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_events "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_sources "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_topvalues "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_exports "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_fgformats "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_fgcontext "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_fgleads "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_matrix "https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html"
click node_webformats "https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html"
click node_urlchecks "https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html"
click node_webleads "https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html"
click node_conversations "https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_loading,node_parsing,node_timeline,node_events,node_sources,node_topvalues,node_exports toneBlue
class node_fgtool,node_fgformats,node_fgcontext,node_fgleads,node_matrix toneAmber
class node_webtool,node_webformats,node_urlchecks,node_webleads,node_conversations toneMint
class node_analyst toneIndigo
```

## Components

### Shared triage capabilities

- [Load and hash files](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [Detect and parse formats](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [Timeline and filters](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [Events table](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [Source cards](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [Top values](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [CSV and case summary](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`

### FortiGate triage

- [FortiGate tool](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [FortiGate formats](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [Device context](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [Firewall leads](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`
- [Communication matrix](https://github.com/deathbydata/oneshot-secops/blob/main/fortigate-log-triage.html): `fortigate-log-triage.html`

### Web access triage

- [Web log tool](https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html): `web-log-triage.html`
- [Web log formats](https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html): `web-log-triage.html`
- [URL pattern checks](https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html): `web-log-triage.html`
- [Web leads](https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html): `web-log-triage.html`
- [Conversations](https://github.com/deathbydata/oneshot-secops/blob/main/web-log-triage.html): `web-log-triage.html`

### Other components

- **Security analyst**

## Connections

- Security analyst → FortiGate tool: opens and analyzes (evidence: `README.md`)
- Security analyst → Web log tool: opens and analyzes (evidence: `README.md`)
- FortiGate tool → Load and hash files: loads files (evidence: `README.md`)
- Web log tool → Load and hash files: loads files (evidence: `README.md`)
- FortiGate tool → Detect and parse formats: detects and parses (evidence: `README.md`)
- Web log tool → Detect and parse formats: detects and parses (evidence: `README.md`)
- FortiGate tool → FortiGate formats: reads (evidence: `README.md`)
- Web log tool → Web log formats: reads (evidence: `README.md`)
- FortiGate tool → Timeline and filters: provides (evidence: `README.md`)
- Web log tool → Timeline and filters: provides (evidence: `README.md`)
- FortiGate tool → Events table: presents (evidence: `README.md`)
- Web log tool → Events table: presents (evidence: `README.md`)
- FortiGate tool → Source cards: provides (evidence: `README.md`)
- Web log tool → Source cards: provides (evidence: `README.md`)
- FortiGate tool → Top values: summarizes (evidence: `README.md`)
- Web log tool → Top values: summarizes (evidence: `README.md`)
- FortiGate tool → Device context: identifies devices (evidence: `README.md`)
- FortiGate tool → Firewall leads: raises heuristic leads (evidence: `README.md`)
- FortiGate tool → Communication matrix: summarizes flows (evidence: `README.md`)
- Web log tool → URL pattern checks: checks decoded URLs (evidence: `README.md`)
- Web log tool → Web leads: raises heuristic leads (evidence: `README.md`)
- Web log tool → Conversations: groups requests (evidence: `README.md`)
- FortiGate tool → CSV and case summary: exports findings (evidence: `README.md`)
- Web log tool → CSV and case summary: exports findings (evidence: `README.md`)