How deepan-crypto/pocketsiem works
PocketSIEM is a threat-intelligence relay with web/mobile frontend entry points. Its principal workflow checks an IP’s reputation; it also accepts crowdsourced threat reports and persists them. The sampled backend service uses a TTL cache and a threat-intelligence client, whose checked-in implementation is mock-based. The README contains no useful capability details, and the checker component and backend configuration were not sampled, so their internal wiring and deployed storage/provider choices are uncertain.
Main entry points: ThreatService.java Threat Service · ThreatController.java Threat Controller · MockThreatIntelligenceClient.java Mock Provider · ThreatIntelligenceClient.java Intel Client
Components 21
Frontend
- Web Entry
frontend/src/main.tsx - Web App
frontend/src/App.tsx - Expo App
frontend/App.tsx - IP Checker
frontend/src/components/IpReputationChecker.tsx - Threat Hook
frontend/src/hooks/useThreatIntelligence.ts - Frontend Service
frontend/src/services/threatService.ts - API Client
frontend/src/services/apiClient.ts
Relay API
- Relay Server
threat-intelligence-relay/src/main/java/com/pocketsiem/PocketSiemApplication.java - Threat Controller
threat-intelligence-relay/src/main/java/com/pocketsiem/controller/ThreatController.java
Reputation Lookup
- Threat Service
threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java - Reputation Cache
threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java - Intel Client
threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatIntelligenceClient.java - Mock Provider
threat-intelligence-relay/src/main/java/com/pocketsiem/service/impl/MockThreatIntelligenceClient.java - Reputation Result
threat-intelligence-relay/src/main/java/com/pocketsiem/dto/IpReputationResponse.java
Threat Reports
- Report Request
threat-intelligence-relay/src/main/java/com/pocketsiem/dto/ThreatReportRequest.java - Threat Report
threat-intelligence-relay/src/main/java/com/pocketsiem/model/ThreatReport.java - Report Repository
threat-intelligence-relay/src/main/java/com/pocketsiem/repository/ThreatReportRepository.java - Report Store
- Report Response
threat-intelligence-relay/src/main/java/com/pocketsiem/dto/ThreatReportResponse.java
Other components
- User
- Intel Source
Connections 25
- User → Web Entry: opens
- Web Entry → Web App: renders
- Web App → IP Checker: renders
- User → Expo App: opens
- Expo App → IP Checker: renders
- Threat Hook → Frontend Service: calls
- Frontend Service → API Client: calls
- API Client → Relay Server: HTTP requests
- Relay Server → Threat Controller: dispatches
- Threat Controller → Threat Service: calls
- Threat Service → Reputation Cache: reads/writes
- Threat Service → Intel Client: calls
- Intel Client → Mock Provider: implemented by
- Mock Provider → Intel Source: looks up
- Mock Provider → Reputation Result: builds
- Threat Service → Reputation Result: returns
- Threat Controller → Reputation Result: returns
- Threat Controller → Report Request: accepts
- Threat Service → Report Request: processes
- Threat Service → Intel Client: checks IP
- Threat Service → Threat Report: creates
- Threat Service → Report Repository: saves
- Report Repository → Report Store: persists
- Threat Service → Report Response: builds
- Threat Controller → Report Response: returns