How effaaykhan/cybersentinel-ids-ips works
CyberSentinel-IPS is a standalone host and network intrusion detection sensor, with optional inline prevention. Its primary workflow is to capture network traffic and poll host sources, normalize and inspect observations, evaluate operator rules, and emit events for local or SIEM consumption. The graph preserves the documented host, network, correlation, and prevention branches. Wiring for some unsampled subsystems is based on the README and module layout; uncertain calls are omitted.
Main entry points: run.rs Run orchestration · pipeline.rs Packet pipeline · sensor.rs Host sensor runtime · lib.rs Rule engine
Components 23
Sensor runtime
- Sensor CLI
crates/cli/src/main.rs - Run orchestration
crates/cli/src/run.rs - Configuration
crates/common/src/config.rs
Network inspection
- Packet capture
crates/capture/src/lib.rs - Packet decoding
crates/decode/src/lib.rs - IP and stream reassembly
crates/reassembly/src/lib.rs - HTTP and TLS parsing
crates/applayer/src/lib.rs - Packet pipeline
crates/cli/src/pipeline.rs
Detection and response
- Rule loading and parsing
crates/rules/src/lib.rs - Rule engine
crates/engine/src/lib.rs - Alert handling
crates/alerting/src/lib.rs - Inline prevention
crates/prevent/src/lib.rs - Cross-domain correlation
crates/correlation/src/lib.rs
Host monitoring
- Host sensor runtime
crates/hids/src/sensor.rs - File integrity
crates/hids/src/fim.rs - Authentication logs
crates/hids/src/logs.rs - Process monitoring
crates/hids/src/process.rs
Events and outputs
- Event model
crates/common/src/event.rs - Event sinks
crates/storage/src/lib.rs
Other components
- Sensor operator
- External SIEM
- Network interfaces
- Host sources
Connections 31
- Sensor operator → Sensor CLI: runs or validates
- Sensor CLI → Run orchestration: dispatches run
- Sensor CLI → Configuration: loads config
- Run orchestration → Configuration: reads settings
- Run orchestration → Packet capture: starts capture
- Network interfaces → Packet capture: supplies packets
- Packet capture → Packet pipeline: delivers frames
- Packet pipeline → Packet decoding: decodes frames
- Packet pipeline → IP and stream reassembly: tracks flows
- Packet pipeline → Rule engine: inspects payloads
- Rule engine → HTTP and TLS parsing: parses app data
- Sensor operator → Rule loading and parsing: provides rules
- Run orchestration → Rule loading and parsing: loads rules
- Rule loading and parsing → Rule engine: compiles rules
- Rule engine → Alert handling: produces alerts
- Run orchestration → Host sensor runtime: polls host sensor
- Host sources → File integrity: provides file state
- Host sources → Authentication logs: provides log records
- Host sources → Process monitoring: provides process state
- Host sensor runtime → File integrity: collects changes
- Host sensor runtime → Authentication logs: parses records
- Host sensor runtime → Process monitoring: monitors activity
- Run orchestration → Cross-domain correlation: correlates observations
- Alert handling → Cross-domain correlation: supplies alerts
- Host sensor runtime → Cross-domain correlation: supplies host events
- Packet pipeline → Event model: emits network events
- Host sensor runtime → Event model: emits host events
- Cross-domain correlation → Event model: emits incidents
- Run orchestration → Event sinks: writes events
- Event sinks → External SIEM: forwards events
- Packet pipeline → Inline prevention: requests verdicts