# effaaykhan/cybersentineldlp-prod architecture

> Architecture diagram of the GitHub repository effaaykhan/cybersentineldlp-prod, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/effaaykhan/cybersentineldlp-prod
- Repository: https://github.com/effaaykhan/cybersentineldlp-prod

## Overview

CyberSentinel DLP detects sensitive data on endpoints and other channels, evaluates policy, and blocks or records risky transfers. The main workflow runs from monitored activity through local or server-side classification and policy decisions to enforcement and audit events; administrators then manage policies and review outcomes in the dashboard. The repository also documents cloud monitoring, outage resilience, device controls, threat intelligence, and SIEM forwarding. Some routes and integrations are represented by their exact tree paths, but their internal wiring was not sampled, so uncertain links are omitted.

Main entry points: [`server/app/api/v1`](https://github.com/effaaykhan/cybersentineldlp-prod/tree/main/server/app/api/v1) (API routes), [`agents/endpoint/windows/agent.cpp`](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/windows/agent.cpp) (Windows agent), [`server/app/policies/decision_engine.py`](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/policies/decision_engine.py) (Decision engine), [`server/app/services/event_processor.py`](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/services/event_processor.py) (Event processing)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Activity capture"]
  node_linux_agent["Linux agent<br/>[agent.py]"]
  node_windows_agent["Windows agent<br/>[agent.cpp]"]
  node_kernel_filter["Kernel filter<br/>[csfilter.c]"]
  node_browser_extension["Browser extension<br/>[scanner.js]"]
  node_smtp_relay["SMTP relay<br/>[handler.py]"]
end

subgraph group_decision["Classification policy"]
  node_classification["Content classification"]
  node_local_policy["Agent policy engine<br/>[policy_engine.h]"]
  node_server_policy["Decision engine<br/>[decision_engine.py]"]
  node_action_executor["Action executor<br/>[action_executor.py]"]
end

subgraph group_platform["Server platform"]
  node_api["API routes"]
  node_event_processing["Event processing<br/>[event_processor.py]"]
  node_database[("Platform databases<br/>[database.py]")]
  node_policy_transformer["Agent policy delivery"]
end

subgraph group_console["Admin dashboard"]
  node_dashboard["Admin dashboard<br/>[App.tsx]"]
  node_dashboard_api["Dashboard API client<br/>[client.ts]"]
end

subgraph group_integrations["External integrations"]
  node_siem_service["SIEM forwarding"]
  node_taxii_ingest["Threat intelligence ingest<br/>[taxii_ingest.py]"]
end

node_endpoint_user(("Endpoint user"))
node_taxii_feed(("TAXII feed"))
node_siem(("SIEM system"))
node_admin(("Administrator"))
node_cloud_storage(("Cloud storage"))

node_endpoint_user -->|"creates activity"| node_linux_agent
node_endpoint_user -->|"creates activity"| node_windows_agent
node_windows_agent -->|"interacts with"| node_kernel_filter
node_linux_agent -->|"evaluates locally"| node_local_policy
node_windows_agent -->|"evaluates locally"| node_local_policy
node_browser_extension -->|"reports detections"| node_api
node_cloud_storage -.->|"monitored activity"| node_api
node_smtp_relay -->|"requests inspection"| node_api
node_api -->|"classifies content"| node_classification
node_classification -->|"provides classification"| node_server_policy
node_api -->|"requests decision"| node_server_policy
node_server_policy -->|"dispatches action"| node_action_executor
node_server_policy -->|"records decision"| node_event_processing
node_api -->|"submits events"| node_event_processing
node_event_processing -->|"stores events"| node_database
node_api -->|"reads and writes"| node_database
node_database -->|"supplies policies"| node_policy_transformer
node_policy_transformer -->|"delivers policy"| node_linux_agent
node_policy_transformer -->|"delivers policy"| node_windows_agent
node_event_processing -->|"forwards events"| node_siem_service
node_siem_service -->|"sends events"| node_siem
node_taxii_feed -->|"publishes indicators"| node_taxii_ingest
node_taxii_ingest -->|"stores indicators"| node_database
node_admin -->|"manages and reviews"| node_dashboard
node_dashboard -->|"requests data"| node_dashboard_api
node_dashboard_api -->|"calls API"| node_api

click node_linux_agent "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/linux/agent.py"
click node_windows_agent "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/windows/agent.cpp"
click node_kernel_filter "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/windows/kernel/csfilter.c"
click node_browser_extension "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/browser-extension/src/scanner.js"
click node_smtp_relay "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/smtp-relay/app/handler.py"
click node_classification "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/services/classification_engine.py"
click node_local_policy "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/windows/policy_engine.h"
click node_server_policy "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/policies/decision_engine.py"
click node_action_executor "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/actions/action_executor.py"
click node_api "https://github.com/effaaykhan/cybersentineldlp-prod/tree/main/server/app/api/v1"
click node_event_processing "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/services/event_processor.py"
click node_database "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/core/database.py"
click node_policy_transformer "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/policies/agent_policy_transformer.py"
click node_siem_service "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/integrations/siem/integration_service.py"
click node_taxii_ingest "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/services/taxii_ingest.py"
click node_dashboard "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/dashboard/src/App.tsx"
click node_dashboard_api "https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/dashboard/src/lib/api/client.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_linux_agent,node_windows_agent,node_kernel_filter,node_browser_extension,node_smtp_relay,node_endpoint_user toneBlue
class node_classification,node_local_policy,node_server_policy,node_action_executor,node_cloud_storage toneAmber
class node_api,node_event_processing,node_database,node_policy_transformer toneMint
class node_dashboard,node_dashboard_api toneRose
class node_siem_service,node_taxii_ingest,node_taxii_feed,node_siem,node_admin toneIndigo
```

## Components

### Activity capture

- [Linux agent](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/linux/agent.py): `agents/endpoint/linux/agent.py`
- [Windows agent](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/windows/agent.cpp): `agents/endpoint/windows/agent.cpp`
- [Kernel filter](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/windows/kernel/csfilter.c): `agents/endpoint/windows/kernel/csfilter.c`
- [Browser extension](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/browser-extension/src/scanner.js): `agents/browser-extension/src/scanner.js`
- [SMTP relay](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/smtp-relay/app/handler.py): `smtp-relay/app/handler.py`

### Classification policy

- [Content classification](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/services/classification_engine.py): `server/app/services/classification_engine.py`
- [Agent policy engine](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/agents/endpoint/windows/policy_engine.h): `agents/endpoint/windows/policy_engine.h`
- [Decision engine](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/policies/decision_engine.py): `server/app/policies/decision_engine.py`
- [Action executor](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/actions/action_executor.py): `server/app/actions/action_executor.py`

### Server platform

- [API routes](https://github.com/effaaykhan/cybersentineldlp-prod/tree/main/server/app/api/v1): `server/app/api/v1`
- [Event processing](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/services/event_processor.py): `server/app/services/event_processor.py`
- [Platform databases](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/core/database.py): `server/app/core/database.py`
- [Agent policy delivery](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/policies/agent_policy_transformer.py): `server/app/policies/agent_policy_transformer.py`

### Admin dashboard

- [Admin dashboard](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/dashboard/src/App.tsx): `dashboard/src/App.tsx`
- [Dashboard API client](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/dashboard/src/lib/api/client.ts): `dashboard/src/lib/api/client.ts`

### External integrations

- [SIEM forwarding](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/integrations/siem/integration_service.py): `server/app/integrations/siem/integration_service.py`
- [Threat intelligence ingest](https://github.com/effaaykhan/cybersentineldlp-prod/blob/main/server/app/services/taxii_ingest.py): `server/app/services/taxii_ingest.py`

### Other components

- **Endpoint user**
- **TAXII feed**
- **SIEM system**
- **Administrator**
- **Cloud storage**

## Connections

- Endpoint user → Linux agent: creates activity
- Endpoint user → Windows agent: creates activity
- Windows agent → Kernel filter: interacts with
- Linux agent → Agent policy engine: evaluates locally
- Windows agent → Agent policy engine: evaluates locally
- Browser extension → API routes: reports detections
- Cloud storage → API routes: monitored activity
- SMTP relay → API routes: requests inspection
- API routes → Content classification: classifies content
- Content classification → Decision engine: provides classification
- API routes → Decision engine: requests decision
- Decision engine → Action executor: dispatches action
- Decision engine → Event processing: records decision
- API routes → Event processing: submits events
- Event processing → Platform databases: stores events
- API routes → Platform databases: reads and writes
- Platform databases → Agent policy delivery: supplies policies
- Agent policy delivery → Linux agent: delivers policy
- Agent policy delivery → Windows agent: delivers policy
- Event processing → SIEM forwarding: forwards events
- SIEM forwarding → SIEM system: sends events
- TAXII feed → Threat intelligence ingest: publishes indicators
- Threat intelligence ingest → Platform databases: stores indicators
- Administrator → Admin dashboard: manages and reviews
- Admin dashboard → Dashboard API client: requests data
- Dashboard API client → API routes: calls API