How essailab/deepxdr works
DeepXDR ingests security telemetry, applies baseline adjudication, correlates high-value events into Short TTPs, and supports longer MITRE ATT&CK investigations with analyst feedback. A separate AgentGuard workflow assesses nono session diffs for intent and change risk, then supports human acceptance or rollback. Analysts use the API and dashboard to inspect results and initiate investigations. The graph follows README-described flows where implementation excerpts were not available; detailed routing and several subsystem internals are therefore represented only at documented boundaries.
Main entry points: routes.py API routes · sql_repository.py PostgreSQL records · graph.py Long TTP investigation · main.py FastAPI
Components 26
Telemetry and adjudication
- Baseline adjudication
baseline_adjudication/anomaly_detector.py
Threat analysis
- Event consumer
ai_agent/data_consumer/kafka_consumer.py - Dynamic event windows
ai_agent/ttp_generator/window_manager.py - Short TTP generation
ai_agent/ttp_generator/short_ttp_generator.py - ATT&CK analysis
ai_agent/mitre_attck_agent/attack_rag.py - Long TTP investigation
ai_agent/mitre_attck_agent/workflows/graph.py - Deep research
ai_agent/ttp_generator/dx_analyzer/deep_researcher.py - Analyst feedback
ai_agent/ttp_generator/human_feedback_session.py
AgentGuard
- AgentGuard consumer
ai_agent/agent_guard/consumer.py - Intent and risk review
ai_agent/agent_guard/adjudicator.py - Risk rules
ai_agent/agent_guard/rule_engine.py - Rollback handling
ai_agent/agent_guard/rollback.py - Rollback publisher
ai_agent/agent_guard/publisher.py
Persistence
- Elasticsearch
ai_agent/shared/database/elasticsearch_client_v8.py - PostgreSQL records
ai_agent/agent_guard/sql_repository.py
Analyst access
- FastAPI
ai_agent/api_server/main.py - API routes
ai_agent/api_server/routes.py - Analyst dashboard
web_ui/src/web/dashboard.py
Other components
- Falco / RASP / Suricata
- Kafka events
- Kafka agent events
- Diff object storage
ai_agent/agent_guard/diff_store.py - Session-finished topic
- Analyst
- nono agent sessions
- MCP defense service
Connections 38
- Falco / RASP / Suricata → Kafka events: publish telemetry
- Kafka events → Baseline adjudication: consume events
- Baseline adjudication → Kafka agent events: forward qualified events
- Kafka agent events → Event consumer: consume events
- Event consumer → Dynamic event windows: add events
- Dynamic event windows → Short TTP generation: deliver closed windows
- Short TTP generation → ATT&CK analysis: map techniques
- Short TTP generation → Elasticsearch: write Short TTP
- Analyst → FastAPI: request investigation
- FastAPI → API routes: dispatch requests
- API routes → Long TTP investigation: start investigation
- Long TTP investigation → Deep research: run research
- Deep research → Analyst feedback: request analyst input
- Analyst feedback → Deep research: provide direction
- Long TTP investigation → PostgreSQL records: save investigation
- Analyst feedback → PostgreSQL records: save feedback
- Elasticsearch → API routes: read TTPs
- PostgreSQL records → API routes: read investigation records
- API routes → FastAPI: return responses
- FastAPI → Analyst dashboard: serve API
- nono agent sessions → Diff object storage: store diff
- nono agent sessions → Kafka events: publish session event
- Baseline adjudication → Session-finished topic: route session events
- Session-finished topic → AgentGuard consumer: consume sessions
- AgentGuard consumer → Diff object storage: read referenced diff
- AgentGuard consumer → Intent and risk review: assess session
- Intent and risk review → Risk rules: check change signals
- AgentGuard consumer → PostgreSQL records: save adjudication
- API routes → PostgreSQL records: query sessions
- Analyst → Analyst dashboard: review findings
- Analyst dashboard → FastAPI: submit decisions
- API routes → Rollback handling: request rollback
- Rollback handling → Rollback publisher: publish restore request
- Rollback publisher → Kafka events: dispatch rollback
- Rollback handling → PostgreSQL records: record rollback state
- ATT&CK analysis → Long TTP investigation: provide ATT&CK context
- Long TTP investigation → ATT&CK analysis: enrich ATT&CK findings
- Short TTP generation → MCP defense service: optional response actions