How ewanoleghe/cti-lab works
CTI-Lab collects global threat intelligence and company-specific risk findings into SQLite, then serves them through a FastAPI API to a React dashboard. The collector is documented as running every two hours; the UI separately requests global articles, company details, and company intelligence. The graph preserves the documented monitoring branches and the sampled persistence/API/UI relationships. Some monitor-to-collector wiring is supported by the source index; unsampled implementation details and external integrations are not expanded beyond shown evidence.
Main entry points: collector.py Scheduled Collector · database.py SQLite Articles · breach_monitor.py Breach Monitor · api.py FastAPI Endpoints
Components 15
Threat Collection
- Scheduled Collector
app/collector.py - Global CTI Feeds
app/feeds.py - Phishing Monitor
app/phishing_monitor.py - Breach Monitor
app/breach_monitor.py - Breach Variant
app/breach_monitor__2.py - Shodan Exposure
app/shodan_monitor.py - Paste Leak Monitor
app/paste_monitor.py - Web Mention Monitor
app/web_monitor.py - Infrastructure Fingerprinting
app/infra_fingerprinting.py - Runtime Configuration
app/config.py
Persistence
- SQLite Articles
app/database.py
API Service
- FastAPI Endpoints
app/api.py
Dashboard
- Dashboard UI
ui/src/App.jsx - React Entry
ui/src/main.jsx
Other components
- CTI Analyst
Connections 20
- CTI Analyst → Dashboard UI: views dashboard
README.md - Scheduled Collector → Global CTI Feeds: collects feeds
app/collector.py - Scheduled Collector → Phishing Monitor: runs monitor
app/collector.py - Scheduled Collector → Breach Monitor: runs monitor
app/collector.py - Scheduled Collector → Shodan Exposure: runs monitor
app/collector.py - Scheduled Collector → Paste Leak Monitor: runs monitor
app/collector.py - Scheduled Collector → Web Mention Monitor: runs monitor
app/collector.py - Scheduled Collector → SQLite Articles: writes findings
app/collector.py - Scheduled Collector → Runtime Configuration: uses settings
app/collector.py - Breach Monitor → SQLite Articles: writes findings
app/breach_monitor.py - Breach Monitor → Runtime Configuration: reads settings
app/breach_monitor.py - Breach Variant → SQLite Articles: writes findings
app/breach_monitor__2.py - Paste Leak Monitor → SQLite Articles: writes findings
app/paste_monitor.py - Web Mention Monitor → SQLite Articles: writes mentions
app/web_monitor.py - Phishing Monitor → SQLite Articles: writes findings
app/phishing_monitor.py - Shodan Exposure → SQLite Articles: writes findings
app/shodan_monitor.py - FastAPI Endpoints → SQLite Articles: reads articles
app/api.py - FastAPI Endpoints → Runtime Configuration: reads settings
app/api.py - Dashboard UI → FastAPI Endpoints: requests data
ui/src/App.jsx - React Entry → Dashboard UI: renders
ui/src/main.jsx