How effaaykhan/cybersentineldlp-prod works
CyberSentinel DLP detects sensitive data on endpoints and other channels, evaluates policy, and blocks or records risky transfers. The main workflow runs from monitored activity through local or server-side classification and policy decisions to enforcement and audit events; administrators then manage policies and review outcomes in the dashboard. The repository also documents cloud monitoring, outage resilience, device controls, threat intelligence, and SIEM forwarding. Some routes and integrations are represented by their exact tree paths, but their internal wiring was not sampled, so uncertain links are omitted.
Main entry points: v1 API routes · agent.cpp Windows agent · decision_engine.py Decision engine · event_processor.py Event processing
Components 22
Activity capture
- Linux agent
agents/endpoint/linux/agent.py - Windows agent
agents/endpoint/windows/agent.cpp - Kernel filter
agents/endpoint/windows/kernel/csfilter.c - Browser extension
agents/browser-extension/src/scanner.js - SMTP relay
smtp-relay/app/handler.py
Classification policy
- Content classification
server/app/services/classification_engine.py - Agent policy engine
agents/endpoint/windows/policy_engine.h - Decision engine
server/app/policies/decision_engine.py - Action executor
server/app/actions/action_executor.py
Server platform
- API routes
server/app/api/v1 - Event processing
server/app/services/event_processor.py - Platform databases
server/app/core/database.py - Agent policy delivery
server/app/policies/agent_policy_transformer.py
Admin dashboard
- Admin dashboard
dashboard/src/App.tsx - Dashboard API client
dashboard/src/lib/api/client.ts
External integrations
- SIEM forwarding
server/app/integrations/siem/integration_service.py - Threat intelligence ingest
server/app/services/taxii_ingest.py
Other components
- Endpoint user
- TAXII feed
- SIEM system
- Administrator
- Cloud storage
Connections 26
- Endpoint user → Linux agent: creates activity
- Endpoint user → Windows agent: creates activity
- Windows agent → Kernel filter: interacts with
- Linux agent → Agent policy engine: evaluates locally
- Windows agent → Agent policy engine: evaluates locally
- Browser extension → API routes: reports detections
- Cloud storage → API routes: monitored activity
- SMTP relay → API routes: requests inspection
- API routes → Content classification: classifies content
- Content classification → Decision engine: provides classification
- API routes → Decision engine: requests decision
- Decision engine → Action executor: dispatches action
- Decision engine → Event processing: records decision
- API routes → Event processing: submits events
- Event processing → Platform databases: stores events
- API routes → Platform databases: reads and writes
- Platform databases → Agent policy delivery: supplies policies
- Agent policy delivery → Linux agent: delivers policy
- Agent policy delivery → Windows agent: delivers policy
- Event processing → SIEM forwarding: forwards events
- SIEM forwarding → SIEM system: sends events
- TAXII feed → Threat intelligence ingest: publishes indicators
- Threat intelligence ingest → Platform databases: stores indicators
- Administrator → Admin dashboard: manages and reviews
- Admin dashboard → Dashboard API client: requests data
- Dashboard API client → API routes: calls API