# effaaykhan/cybersentinel-ids-ips architecture

> Architecture diagram of the GitHub repository effaaykhan/cybersentinel-ids-ips, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/effaaykhan/cybersentinel-ids-ips
- Repository: https://github.com/effaaykhan/cybersentinel-ids-ips

## Overview

CyberSentinel-IPS is a standalone host and network intrusion detection sensor, with optional inline prevention. Its primary workflow is to capture network traffic and poll host sources, normalize and inspect observations, evaluate operator rules, and emit events for local or SIEM consumption. The graph preserves the documented host, network, correlation, and prevention branches. Wiring for some unsampled subsystems is based on the README and module layout; uncertain calls are omitted.

Main entry points: [`crates/cli/src/run.rs`](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/cli/src/run.rs) (Run orchestration), [`crates/cli/src/pipeline.rs`](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/cli/src/pipeline.rs) (Packet pipeline), [`crates/hids/src/sensor.rs`](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/sensor.rs) (Host sensor runtime), [`crates/engine/src/lib.rs`](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/engine/src/lib.rs) (Rule engine)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Sensor runtime"]
  node_cli["Sensor CLI<br/>[main.rs]"]
  node_run["Run orchestration<br/>[run.rs]"]
  node_config["Configuration<br/>[config.rs]"]
end

subgraph group_network["Network inspection"]
  node_capture["Packet capture<br/>[lib.rs]"]
  node_decode["Packet decoding<br/>[lib.rs]"]
  node_reassembly["IP and stream reassembly<br/>[lib.rs]"]
  node_applayer["HTTP and TLS parsing<br/>[lib.rs]"]
  node_pipeline["Packet pipeline<br/>[pipeline.rs]"]
end

subgraph group_detection["Detection and response"]
  node_rules["Rule loading and parsing<br/>[lib.rs]"]
  node_engine["Rule engine<br/>[lib.rs]"]
  node_alerting["Alert handling<br/>[lib.rs]"]
  node_prevention["Inline prevention<br/>[lib.rs]"]
  node_correlation["Cross-domain correlation<br/>[lib.rs]"]
end

subgraph group_host["Host monitoring"]
  node_hostsensor["Host sensor runtime<br/>[sensor.rs]"]
  node_fim["File integrity<br/>[fim.rs]"]
  node_authlogs["Authentication logs<br/>[logs.rs]"]
  node_processes["Process monitoring<br/>[process.rs]"]
end

subgraph group_outputs["Events and outputs"]
  node_events["Event model<br/>[event.rs]"]
  node_storage["Event sinks<br/>[lib.rs]"]
end

node_operator(("Sensor operator"))
node_siem["External SIEM"]
node_networksource(("Network interfaces"))
node_hostos(("Host sources"))

node_operator -->|"runs or validates"| node_cli
node_cli -->|"dispatches run"| node_run
node_cli -->|"loads config"| node_config
node_run -->|"reads settings"| node_config
node_run -->|"starts capture"| node_capture
node_networksource -->|"supplies packets"| node_capture
node_capture -->|"delivers frames"| node_pipeline
node_pipeline -->|"decodes frames"| node_decode
node_pipeline -->|"tracks flows"| node_reassembly
node_pipeline -->|"inspects payloads"| node_engine
node_engine -->|"parses app data"| node_applayer
node_operator -->|"provides rules"| node_rules
node_run -->|"loads rules"| node_rules
node_rules -->|"compiles rules"| node_engine
node_engine -->|"produces alerts"| node_alerting
node_run -->|"polls host sensor"| node_hostsensor
node_hostos -->|"provides file state"| node_fim
node_hostos -->|"provides log records"| node_authlogs
node_hostos -->|"provides process state"| node_processes
node_hostsensor -->|"collects changes"| node_fim
node_hostsensor -->|"parses records"| node_authlogs
node_hostsensor -->|"monitors activity"| node_processes
node_run -->|"correlates observations"| node_correlation
node_alerting -->|"supplies alerts"| node_correlation
node_hostsensor -->|"supplies host events"| node_correlation
node_pipeline -->|"emits network events"| node_events
node_hostsensor -->|"emits host events"| node_events
node_correlation -->|"emits incidents"| node_events
node_run -->|"writes events"| node_storage
node_storage -.->|"forwards events"| node_siem
node_pipeline -.->|"requests verdicts"| node_prevention

click node_cli "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/cli/src/main.rs"
click node_run "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/cli/src/run.rs"
click node_config "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/common/src/config.rs"
click node_capture "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/capture/src/lib.rs"
click node_decode "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/decode/src/lib.rs"
click node_reassembly "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/reassembly/src/lib.rs"
click node_applayer "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/applayer/src/lib.rs"
click node_pipeline "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/cli/src/pipeline.rs"
click node_rules "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/rules/src/lib.rs"
click node_engine "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/engine/src/lib.rs"
click node_alerting "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/alerting/src/lib.rs"
click node_prevention "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/prevent/src/lib.rs"
click node_hostsensor "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/sensor.rs"
click node_fim "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/fim.rs"
click node_authlogs "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/logs.rs"
click node_processes "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/process.rs"
click node_correlation "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/correlation/src/lib.rs"
click node_events "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/common/src/event.rs"
click node_storage "https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/storage/src/lib.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_run,node_config toneBlue
class node_capture,node_decode,node_reassembly,node_applayer,node_pipeline toneAmber
class node_rules,node_engine,node_alerting,node_prevention,node_correlation toneMint
class node_hostsensor,node_fim,node_authlogs,node_processes toneRose
class node_events,node_storage,node_operator,node_siem,node_networksource,node_hostos toneIndigo
```

## Components

### Sensor runtime

- [Sensor CLI](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/cli/src/main.rs): `crates/cli/src/main.rs`
- [Run orchestration](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/cli/src/run.rs): `crates/cli/src/run.rs`
- [Configuration](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/common/src/config.rs): `crates/common/src/config.rs`

### Network inspection

- [Packet capture](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/capture/src/lib.rs): `crates/capture/src/lib.rs`
- [Packet decoding](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/decode/src/lib.rs): `crates/decode/src/lib.rs`
- [IP and stream reassembly](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/reassembly/src/lib.rs): `crates/reassembly/src/lib.rs`
- [HTTP and TLS parsing](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/applayer/src/lib.rs): `crates/applayer/src/lib.rs`
- [Packet pipeline](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/cli/src/pipeline.rs): `crates/cli/src/pipeline.rs`

### Detection and response

- [Rule loading and parsing](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/rules/src/lib.rs): `crates/rules/src/lib.rs`
- [Rule engine](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/engine/src/lib.rs): `crates/engine/src/lib.rs`
- [Alert handling](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/alerting/src/lib.rs): `crates/alerting/src/lib.rs`
- [Inline prevention](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/prevent/src/lib.rs): `crates/prevent/src/lib.rs`
- [Cross-domain correlation](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/correlation/src/lib.rs): `crates/correlation/src/lib.rs`

### Host monitoring

- [Host sensor runtime](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/sensor.rs): `crates/hids/src/sensor.rs`
- [File integrity](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/fim.rs): `crates/hids/src/fim.rs`
- [Authentication logs](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/logs.rs): `crates/hids/src/logs.rs`
- [Process monitoring](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/hids/src/process.rs): `crates/hids/src/process.rs`

### Events and outputs

- [Event model](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/common/src/event.rs): `crates/common/src/event.rs`
- [Event sinks](https://github.com/effaaykhan/cybersentinel-ids-ips/blob/main/crates/storage/src/lib.rs): `crates/storage/src/lib.rs`

### Other components

- **Sensor operator**
- **External SIEM**
- **Network interfaces**
- **Host sources**

## Connections

- Sensor operator → Sensor CLI: runs or validates
- Sensor CLI → Run orchestration: dispatches run
- Sensor CLI → Configuration: loads config
- Run orchestration → Configuration: reads settings
- Run orchestration → Packet capture: starts capture
- Network interfaces → Packet capture: supplies packets
- Packet capture → Packet pipeline: delivers frames
- Packet pipeline → Packet decoding: decodes frames
- Packet pipeline → IP and stream reassembly: tracks flows
- Packet pipeline → Rule engine: inspects payloads
- Rule engine → HTTP and TLS parsing: parses app data
- Sensor operator → Rule loading and parsing: provides rules
- Run orchestration → Rule loading and parsing: loads rules
- Rule loading and parsing → Rule engine: compiles rules
- Rule engine → Alert handling: produces alerts
- Run orchestration → Host sensor runtime: polls host sensor
- Host sources → File integrity: provides file state
- Host sources → Authentication logs: provides log records
- Host sources → Process monitoring: provides process state
- Host sensor runtime → File integrity: collects changes
- Host sensor runtime → Authentication logs: parses records
- Host sensor runtime → Process monitoring: monitors activity
- Run orchestration → Cross-domain correlation: correlates observations
- Alert handling → Cross-domain correlation: supplies alerts
- Host sensor runtime → Cross-domain correlation: supplies host events
- Packet pipeline → Event model: emits network events
- Host sensor runtime → Event model: emits host events
- Cross-domain correlation → Event model: emits incidents
- Run orchestration → Event sinks: writes events
- Event sinks → External SIEM: forwards events
- Packet pipeline → Inline prevention: requests verdicts