# deepan-crypto/pocketsiem architecture

> Architecture diagram of the GitHub repository deepan-crypto/pocketsiem, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/deepan-crypto/pocketsiem
- Repository: https://github.com/deepan-crypto/pocketsiem

## Overview

PocketSIEM is a threat-intelligence relay with web/mobile frontend entry points. Its principal workflow checks an IP’s reputation; it also accepts crowdsourced threat reports and persists them. The sampled backend service uses a TTL cache and a threat-intelligence client, whose checked-in implementation is mock-based. The README contains no useful capability details, and the checker component and backend configuration were not sampled, so their internal wiring and deployed storage/provider choices are uncertain.

Main entry points: [`threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java`](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java) (Threat Service), [`threat-intelligence-relay/src/main/java/com/pocketsiem/controller/ThreatController.java`](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/controller/ThreatController.java) (Threat Controller), [`threat-intelligence-relay/src/main/java/com/pocketsiem/service/impl/MockThreatIntelligenceClient.java`](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/impl/MockThreatIntelligenceClient.java) (Mock Provider), [`threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatIntelligenceClient.java`](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatIntelligenceClient.java) (Intel Client)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_frontend["Frontend"]
  node_web_entry["Web Entry<br/>[main.tsx]"]
  node_web_app["Web App<br/>[App.tsx]"]
  node_expo_app["Expo App<br/>[App.tsx]"]
  node_checker["IP Checker"]
  node_hook["Threat Hook"]
  node_threat_service["Frontend Service<br/>[threatService.ts]"]
  node_api_client["API Client<br/>[apiClient.ts]"]
end

subgraph group_api["Relay API"]
  node_relay["Relay Server"]
  node_controller["Threat Controller"]
end

subgraph group_intel["Reputation Lookup"]
  node_backend_service["Threat Service<br/>[ThreatService.java]"]
  node_cache[("Reputation Cache<br/>[ThreatService.java]")]
  node_intel_client["Intel Client"]
  node_mock_client["Mock Provider"]
  node_reputation_response["Reputation Result"]
end

subgraph group_reports["Threat Reports"]
  node_report_request["Report Request"]
  node_report_entity["Threat Report<br/>[ThreatReport.java]"]
  node_report_repo["Report Repository"]
  node_report_store[("Report Store")]
  node_report_response["Report Response"]
end

node_user(("User"))
node_intel_source[("Intel Source")]

node_user -->|"opens"| node_web_entry
node_web_entry -->|"renders"| node_web_app
node_web_app -->|"renders"| node_checker
node_user -->|"opens"| node_expo_app
node_expo_app -->|"renders"| node_checker
node_hook -->|"calls"| node_threat_service
node_threat_service -->|"calls"| node_api_client
node_api_client -->|"HTTP requests"| node_relay
node_relay -->|"dispatches"| node_controller
node_controller -->|"calls"| node_backend_service
node_backend_service -->|"reads/writes"| node_cache
node_backend_service -->|"calls"| node_intel_client
node_intel_client -->|"implemented by"| node_mock_client
node_mock_client -.->|"looks up"| node_intel_source
node_mock_client -->|"builds"| node_reputation_response
node_backend_service -->|"returns"| node_reputation_response
node_controller -->|"returns"| node_reputation_response
node_controller -->|"accepts"| node_report_request
node_backend_service -->|"processes"| node_report_request
node_backend_service -->|"checks IP"| node_intel_client
node_backend_service -->|"creates"| node_report_entity
node_backend_service -->|"saves"| node_report_repo
node_report_repo -->|"persists"| node_report_store
node_backend_service -->|"builds"| node_report_response
node_controller -->|"returns"| node_report_response

click node_web_entry "https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/main.tsx"
click node_web_app "https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/App.tsx"
click node_expo_app "https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/App.tsx"
click node_checker "https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/components/IpReputationChecker.tsx"
click node_hook "https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/hooks/useThreatIntelligence.ts"
click node_threat_service "https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/services/threatService.ts"
click node_api_client "https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/services/apiClient.ts"
click node_relay "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/PocketSiemApplication.java"
click node_controller "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/controller/ThreatController.java"
click node_backend_service "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java"
click node_cache "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java"
click node_intel_client "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatIntelligenceClient.java"
click node_mock_client "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/impl/MockThreatIntelligenceClient.java"
click node_report_request "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/dto/ThreatReportRequest.java"
click node_report_entity "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/model/ThreatReport.java"
click node_report_repo "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/repository/ThreatReportRepository.java"
click node_report_response "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/dto/ThreatReportResponse.java"
click node_reputation_response "https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/dto/IpReputationResponse.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_web_entry,node_web_app,node_expo_app,node_checker,node_hook,node_threat_service,node_api_client,node_user toneBlue
class node_relay,node_controller,node_intel_source toneAmber
class node_backend_service,node_cache,node_intel_client,node_mock_client,node_reputation_response toneMint
class node_report_request,node_report_entity,node_report_repo,node_report_store,node_report_response toneRose
```

## Components

### Frontend

- [Web Entry](https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/main.tsx): `frontend/src/main.tsx`
- [Web App](https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/App.tsx): `frontend/src/App.tsx`
- [Expo App](https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/App.tsx): `frontend/App.tsx`
- [IP Checker](https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/components/IpReputationChecker.tsx): `frontend/src/components/IpReputationChecker.tsx`
- [Threat Hook](https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/hooks/useThreatIntelligence.ts): `frontend/src/hooks/useThreatIntelligence.ts`
- [Frontend Service](https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/services/threatService.ts): `frontend/src/services/threatService.ts`
- [API Client](https://github.com/deepan-crypto/pocketsiem/blob/main/frontend/src/services/apiClient.ts): `frontend/src/services/apiClient.ts`

### Relay API

- [Relay Server](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/PocketSiemApplication.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/PocketSiemApplication.java`
- [Threat Controller](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/controller/ThreatController.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/controller/ThreatController.java`

### Reputation Lookup

- [Threat Service](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java`
- [Reputation Cache](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatService.java`
- [Intel Client](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatIntelligenceClient.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/service/ThreatIntelligenceClient.java`
- [Mock Provider](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/service/impl/MockThreatIntelligenceClient.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/service/impl/MockThreatIntelligenceClient.java`
- [Reputation Result](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/dto/IpReputationResponse.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/dto/IpReputationResponse.java`

### Threat Reports

- [Report Request](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/dto/ThreatReportRequest.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/dto/ThreatReportRequest.java`
- [Threat Report](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/model/ThreatReport.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/model/ThreatReport.java`
- [Report Repository](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/repository/ThreatReportRepository.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/repository/ThreatReportRepository.java`
- **Report Store**
- [Report Response](https://github.com/deepan-crypto/pocketsiem/blob/main/threat-intelligence-relay/src/main/java/com/pocketsiem/dto/ThreatReportResponse.java): `threat-intelligence-relay/src/main/java/com/pocketsiem/dto/ThreatReportResponse.java`

### Other components

- **User**
- **Intel Source**

## Connections

- User → Web Entry: opens
- Web Entry → Web App: renders
- Web App → IP Checker: renders
- User → Expo App: opens
- Expo App → IP Checker: renders
- Threat Hook → Frontend Service: calls
- Frontend Service → API Client: calls
- API Client → Relay Server: HTTP requests
- Relay Server → Threat Controller: dispatches
- Threat Controller → Threat Service: calls
- Threat Service → Reputation Cache: reads/writes
- Threat Service → Intel Client: calls
- Intel Client → Mock Provider: implemented by
- Mock Provider → Intel Source: looks up
- Mock Provider → Reputation Result: builds
- Threat Service → Reputation Result: returns
- Threat Controller → Reputation Result: returns
- Threat Controller → Report Request: accepts
- Threat Service → Report Request: processes
- Threat Service → Intel Client: checks IP
- Threat Service → Threat Report: creates
- Threat Service → Report Repository: saves
- Report Repository → Report Store: persists
- Threat Service → Report Response: builds
- Threat Controller → Report Response: returns