# ethan-andrews/threatintel-aggregator architecture

> Architecture diagram of the GitHub repository ethan-andrews/threatintel-aggregator, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ethan-andrews/threatintel-aggregator
- Repository: https://github.com/ethan-andrews/threatintel-aggregator

## Overview

Threat Intel Aggregator is a self-hosted threat-intelligence platform: users review ingested security feeds, triaged articles and extracted indicators, and correlate threats with their environment. The main path runs from scheduled feed collection and triage through backend APIs to the dashboard. Separate product branches provide IOC and MITRE views, RunZero exposure, and detection review with Sentinel synchronization and tuning. The README documents capabilities whose internal wiring is not established by the sampled source; those are represented without speculative call chains.

Main entry points: [`backend/main.py`](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/main.py) (Backend API), [`backend/db.py`](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/db.py) (Application Database), [`backend/feed_manager.py`](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/feed_manager.py) (Feed Collection), [`backend/detection_pipeline/orchestrator.py`](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/orchestrator.py) (TI Detection Pipeline)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_intel["Threat Intelligence"]
  node_feedmanager["Feed Collection<br/>[feed_manager.py]"]
  node_triage["AI Triage<br/>[feed_manager.py]"]
  node_enrichment["Enrichment<br/>[enrichment.py]"]
  node_iocs["IOC Ledger<br/>[ioc_export.py]"]
  node_mitre["MITRE Coverage<br/>[mitre_tactics.py]"]
end

subgraph group_environment["Environment Context"]
  node_runsync["RunZero Sync<br/>[runzero_sync.py]"]
  node_stack["Your Stack<br/>[stack_presets.py]"]
  node_exposure["Exposure Tracking<br/>[main.py]"]
end

subgraph group_detections["Detection Operations"]
  node_detectionui["Detection Review<br/>[DetectionsPanel.js]"]
  node_coverage["Coverage Ledger<br/>[coverage_ledger.py]"]
  node_orchestrator["TI Detection Pipeline<br/>[orchestrator.py]"]
  node_sentinel["Sentinel Operations<br/>[sentinel.py]"]
  node_tuning["Tuning Suggestions"]
  node_tuningui["Tuning Controls"]
end

subgraph group_application["Application"]
  node_web["Dashboard<br/>[index.js]"]
  node_filters["Dashboard Filters<br/>[FilterContext.js]"]
  node_api["Backend API<br/>[main.py]"]
  node_database[("Application Database<br/>[db.py]")]
end

node_analyst(("Analyst"))
node_rss(("Security Feeds"))
node_runzero(("RunZero Inventory"))
node_detectionsai(("detections.ai"))
node_sentinelservice(("Microsoft Sentinel"))

node_analyst -->|"uses"| node_web
node_web -->|"requests data"| node_api
node_web -->|"sets filters"| node_filters
node_rss -->|"provides feeds"| node_feedmanager
node_feedmanager -->|"fetches articles"| node_rss
node_feedmanager -->|"triages entries"| node_triage
node_feedmanager -->|"stores entries"| node_database
node_triage -->|"stores results"| node_database
node_triage -->|"enriches entries"| node_enrichment
node_api -->|"reads and writes"| node_database
node_api -->|"serves IOC export"| node_iocs
node_api -->|"serves MITRE data"| node_mitre
node_api -->|"schedules sync"| node_runsync
node_runzero -->|"provides inventory"| node_runsync
node_runsync -->|"stores matches"| node_database
node_api -->|"serves stack settings"| node_stack
node_api -->|"serves exposure data"| node_exposure
node_detectionui -->|"requests reviews"| node_api
node_api -->|"uses coverage ledger"| node_coverage
node_orchestrator -->|"reads outbox"| node_database
node_orchestrator -.->|"submits intel"| node_detectionsai
node_orchestrator -->|"syncs hunts"| node_sentinel
node_sentinel -->|"queries and syncs"| node_sentinelservice
node_api -->|"applies suggestions"| node_tuning
node_tuningui -->|"posts actions"| node_api

click node_feedmanager "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/feed_manager.py"
click node_triage "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/feed_manager.py"
click node_enrichment "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/enrichment.py"
click node_iocs "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/ioc_export.py"
click node_mitre "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/mitre_tactics.py"
click node_runsync "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/runzero_sync.py"
click node_stack "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/stack_presets.py"
click node_exposure "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/main.py"
click node_web "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/frontend/pages/index.js"
click node_filters "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/frontend/context/FilterContext.js"
click node_api "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/main.py"
click node_database "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/db.py"
click node_detectionui "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/frontend/components/detections/DetectionsPanel.js"
click node_coverage "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/coverage_ledger.py"
click node_orchestrator "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/orchestrator.py"
click node_sentinel "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/sentinel.py"
click node_tuning "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/tuning_suggestions.py"
click node_tuningui "https://github.com/ethan-andrews/threatintel-aggregator/blob/main/frontend/components/detections/useTuningSuggestions.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_feedmanager,node_triage,node_enrichment,node_iocs,node_mitre toneBlue
class node_runsync,node_stack,node_exposure toneAmber
class node_detectionui,node_coverage,node_orchestrator,node_sentinel,node_tuning,node_tuningui toneMint
class node_web,node_filters,node_api,node_database toneRose
class node_analyst,node_rss,node_runzero,node_detectionsai,node_sentinelservice toneIndigo
```

## Components

### Threat Intelligence

- [Feed Collection](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/feed_manager.py): `backend/feed_manager.py`
- [AI Triage](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/feed_manager.py): `backend/feed_manager.py`
- [Enrichment](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/enrichment.py): `backend/enrichment.py`
- [IOC Ledger](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/ioc_export.py): `backend/ioc_export.py`
- [MITRE Coverage](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/mitre_tactics.py): `backend/detection_pipeline/mitre_tactics.py`

### Environment Context

- [RunZero Sync](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/runzero_sync.py): `backend/runzero_sync.py`
- [Your Stack](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/stack_presets.py): `backend/stack_presets.py`
- [Exposure Tracking](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/main.py): `backend/main.py`

### Detection Operations

- [Detection Review](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/frontend/components/detections/DetectionsPanel.js): `frontend/components/detections/DetectionsPanel.js`
- [Coverage Ledger](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/coverage_ledger.py): `backend/detection_pipeline/coverage_ledger.py`
- [TI Detection Pipeline](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/orchestrator.py): `backend/detection_pipeline/orchestrator.py`
- [Sentinel Operations](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/sentinel.py): `backend/detection_pipeline/sentinel.py`
- [Tuning Suggestions](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/detection_pipeline/tuning_suggestions.py): `backend/detection_pipeline/tuning_suggestions.py`
- [Tuning Controls](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/frontend/components/detections/useTuningSuggestions.js): `frontend/components/detections/useTuningSuggestions.js`

### Application

- [Dashboard](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/frontend/pages/index.js): `frontend/pages/index.js`
- [Dashboard Filters](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/frontend/context/FilterContext.js): `frontend/context/FilterContext.js`
- [Backend API](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/main.py): `backend/main.py`
- [Application Database](https://github.com/ethan-andrews/threatintel-aggregator/blob/main/backend/db.py): `backend/db.py`

### Other components

- **Analyst**
- **Security Feeds**
- **RunZero Inventory**
- **detections.ai**
- **Microsoft Sentinel**

## Connections

- Analyst → Dashboard: uses
- Dashboard → Backend API: requests data
- Dashboard → Dashboard Filters: sets filters
- Security Feeds → Feed Collection: provides feeds
- Feed Collection → Security Feeds: fetches articles
- Feed Collection → AI Triage: triages entries
- Feed Collection → Application Database: stores entries
- AI Triage → Application Database: stores results
- AI Triage → Enrichment: enriches entries
- Backend API → Application Database: reads and writes
- Backend API → IOC Ledger: serves IOC export
- Backend API → MITRE Coverage: serves MITRE data
- Backend API → RunZero Sync: schedules sync
- RunZero Inventory → RunZero Sync: provides inventory
- RunZero Sync → Application Database: stores matches
- Backend API → Your Stack: serves stack settings
- Backend API → Exposure Tracking: serves exposure data
- Detection Review → Backend API: requests reviews
- Backend API → Coverage Ledger: uses coverage ledger
- TI Detection Pipeline → Application Database: reads outbox
- TI Detection Pipeline → detections.ai: submits intel
- TI Detection Pipeline → Sentinel Operations: syncs hunts
- Sentinel Operations → Microsoft Sentinel: queries and syncs
- Backend API → Tuning Suggestions: applies suggestions
- Tuning Controls → Backend API: posts actions