How dynasmon/seagull works
Seagull is a security operations platform: endpoint and network telemetry enters through agent-facing APIs and ingestion workers, is analyzed by detection and intelligence workers, and becomes alerts, incidents, and investigation data for the analyst portal. Separate product branches cover fleet management, topology and exposure, vulnerability correlation, and behavioral analytics. The README documents the broad service and storage relationships; sampled source additionally confirms rule execution and alert-pipeline stages. Several feature internals were not sampled, so their links are limited to documented relationships.
Main entry points: app/main.py FastAPI control plane · models.py Alert triage · routes.tsx Analyst portal · ingest/main.py Ingest workers
Components 30
Collection and fleet
- Agent API
backend/app/features/agents/api.py - Ingest API
backend/app/features/ingest/api.py - Ingest workers
backend/app/workers/ingest/main.py - Fleet management
backend/app/features/agents
Detection and intelligence
- Detection rules
backend/app/features/detections/rules - Rule evaluation
backend/app/workers/intelligence/rules/engine.py - Rule conditions
backend/app/workers/intelligence/rules/conditions.py - Alert deduplication
backend/app/workers/intelligence/rules/dedup.py - Alert pipeline
backend/app/features/detections/pipeline/pipeline.py - Correlations
backend/app/features/correlations/bootstrap.py - Attack chains
backend/app/features/attack_chain/domain/story_engine.py - Behavioral analytics
backend/app/features/ueba - Topology and exposure
backend/app/features/network_topology - Vulnerability detection
backend/app/features/vuln
Analyst operations
- Analyst portal
frontend/src/app/routes.tsx - Event hunting
backend/app/features/events/api.py - Alert triage
backend/app/features/alerts/models.py - Investigations
backend/app/features/investigations - Realtime updates
backend/app/features/realtime/api.py
Platform services
- FastAPI control plane
backend/app/main.py - Database lifecycle
backend/app/core/db/lifecycle.py - Database engine
backend/app/core/db/engine.py - Configuration
backend/app/core/config/settings.py - Observability
backend/app/core/observability - PostgreSQL
- ClickHouse
- Elasticsearch
- Redis
Other components
- Seagull Agent
- Security analyst
Connections 30
- Seagull Agent → Agent API: enrolls with
- Seagull Agent → Ingest API: sends telemetry
- Ingest API → Ingest workers: buffers batches
- Ingest workers → Redis: queues through
- Ingest workers → ClickHouse: writes analytics
- Ingest workers → Elasticsearch: indexes events
- Agent API → Fleet management: supports enrollment
- Detection rules → Rule evaluation: evaluated by
backend/app/workers/intelligence/rules/engine.py - Rule evaluation → Rule conditions: evaluates with
backend/app/workers/intelligence/rules/engine.py - Rule evaluation → Alert pipeline: runs pipeline
backend/app/workers/intelligence/rules/engine.py - Alert pipeline → Alert deduplication: uses deduplication
backend/app/features/detections/pipeline/pipeline.py - Rule evaluation → Alert triage: creates alerts
backend/app/workers/intelligence/rules/engine.py - Correlations → Alert triage: groups detections
- Attack chains → Alert triage: assembles activity
- Behavioral analytics → Alert triage: reports anomalies
- Topology and exposure → Alert triage: informs exposure
- Vulnerability detection → Topology and exposure: correlates host exposure
- Security analyst → Analyst portal: uses
- Analyst portal → Event hunting: hunts events
- Analyst portal → Alert triage: triages alerts
- Analyst portal → Investigations: tracks evidence
- Analyst portal → Topology and exposure: explores topology
- FastAPI control plane → Agent API: serves API
backend/app/main.py - FastAPI control plane → Ingest API: serves API
backend/app/main.py - FastAPI control plane → PostgreSQL: uses operational state
- FastAPI control plane → Realtime updates: serves realtime API
backend/app/main.py - FastAPI control plane → Observability: records telemetry
backend/app/main.py - Database lifecycle → Database engine: uses engine
backend/app/core/db/lifecycle.py - Database engine → Configuration: reads configuration
backend/app/core/db/engine.py - FastAPI control plane → Configuration: loads configuration
backend/app/main.py