# ewanoleghe/cti-lab architecture

> Architecture diagram of the GitHub repository ewanoleghe/cti-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ewanoleghe/cti-lab
- Repository: https://github.com/ewanoleghe/cti-lab

## Overview

CTI-Lab collects global threat intelligence and company-specific risk findings into SQLite, then serves them through a FastAPI API to a React dashboard. The collector is documented as running every two hours; the UI separately requests global articles, company details, and company intelligence. The graph preserves the documented monitoring branches and the sampled persistence/API/UI relationships. Some monitor-to-collector wiring is supported by the source index; unsampled implementation details and external integrations are not expanded beyond shown evidence.

Main entry points: [`app/collector.py`](https://github.com/ewanoleghe/cti-lab/blob/main/app/collector.py) (Scheduled Collector), [`app/database.py`](https://github.com/ewanoleghe/cti-lab/blob/main/app/database.py) (SQLite Articles), [`app/breach_monitor.py`](https://github.com/ewanoleghe/cti-lab/blob/main/app/breach_monitor.py) (Breach Monitor), [`app/api.py`](https://github.com/ewanoleghe/cti-lab/blob/main/app/api.py) (FastAPI Endpoints)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Threat Collection"]
  node_collector["Scheduled Collector<br/>[collector.py]"]
  node_feeds["Global CTI Feeds<br/>[feeds.py]"]
  node_phishing["Phishing Monitor"]
  node_breach["Breach Monitor<br/>[breach_monitor.py]"]
  node_breach_alt["Breach Variant"]
  node_shodan["Shodan Exposure<br/>[shodan_monitor.py]"]
  node_paste["Paste Leak Monitor<br/>[paste_monitor.py]"]
  node_web["Web Mention Monitor<br/>[web_monitor.py]"]
  node_fingerprint["Infrastructure Fingerprinting"]
  node_config["Runtime Configuration<br/>[config.py]"]
end

subgraph group_storage["Persistence"]
  node_db[("SQLite Articles<br/>[database.py]")]
end

subgraph group_service["API Service"]
  node_api["FastAPI Endpoints<br/>[api.py]"]
end

subgraph group_frontend["Dashboard"]
  node_app["Dashboard UI<br/>[App.jsx]"]
  node_mount["React Entry<br/>[main.jsx]"]
end

node_analyst(("CTI Analyst"))

node_analyst -->|"views dashboard"| node_app
node_collector -->|"collects feeds"| node_feeds
node_collector -->|"runs monitor"| node_phishing
node_collector -->|"runs monitor"| node_breach
node_collector -->|"runs monitor"| node_shodan
node_collector -->|"runs monitor"| node_paste
node_collector -->|"runs monitor"| node_web
node_collector -->|"writes findings"| node_db
node_collector -->|"uses settings"| node_config
node_breach -->|"writes findings"| node_db
node_breach -->|"reads settings"| node_config
node_breach_alt -->|"writes findings"| node_db
node_paste -->|"writes findings"| node_db
node_web -->|"writes mentions"| node_db
node_phishing -->|"writes findings"| node_db
node_shodan -->|"writes findings"| node_db
node_api -->|"reads articles"| node_db
node_api -->|"reads settings"| node_config
node_app -->|"requests data"| node_api
node_mount -->|"renders"| node_app

click node_collector "https://github.com/ewanoleghe/cti-lab/blob/main/app/collector.py"
click node_feeds "https://github.com/ewanoleghe/cti-lab/blob/main/app/feeds.py"
click node_phishing "https://github.com/ewanoleghe/cti-lab/blob/main/app/phishing_monitor.py"
click node_breach "https://github.com/ewanoleghe/cti-lab/blob/main/app/breach_monitor.py"
click node_breach_alt "https://github.com/ewanoleghe/cti-lab/blob/main/app/breach_monitor__2.py"
click node_shodan "https://github.com/ewanoleghe/cti-lab/blob/main/app/shodan_monitor.py"
click node_paste "https://github.com/ewanoleghe/cti-lab/blob/main/app/paste_monitor.py"
click node_web "https://github.com/ewanoleghe/cti-lab/blob/main/app/web_monitor.py"
click node_fingerprint "https://github.com/ewanoleghe/cti-lab/blob/main/app/infra_fingerprinting.py"
click node_config "https://github.com/ewanoleghe/cti-lab/blob/main/app/config.py"
click node_db "https://github.com/ewanoleghe/cti-lab/blob/main/app/database.py"
click node_api "https://github.com/ewanoleghe/cti-lab/blob/main/app/api.py"
click node_app "https://github.com/ewanoleghe/cti-lab/blob/main/ui/src/App.jsx"
click node_mount "https://github.com/ewanoleghe/cti-lab/blob/main/ui/src/main.jsx"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_collector,node_feeds,node_phishing,node_breach,node_breach_alt,node_shodan,node_paste,node_web,node_fingerprint,node_config toneBlue
class node_db toneAmber
class node_api toneMint
class node_app,node_mount toneRose
class node_analyst toneIndigo
```

## Components

### Threat Collection

- [Scheduled Collector](https://github.com/ewanoleghe/cti-lab/blob/main/app/collector.py): `app/collector.py`
- [Global CTI Feeds](https://github.com/ewanoleghe/cti-lab/blob/main/app/feeds.py): `app/feeds.py`
- [Phishing Monitor](https://github.com/ewanoleghe/cti-lab/blob/main/app/phishing_monitor.py): `app/phishing_monitor.py`
- [Breach Monitor](https://github.com/ewanoleghe/cti-lab/blob/main/app/breach_monitor.py): `app/breach_monitor.py`
- [Breach Variant](https://github.com/ewanoleghe/cti-lab/blob/main/app/breach_monitor__2.py): `app/breach_monitor__2.py`
- [Shodan Exposure](https://github.com/ewanoleghe/cti-lab/blob/main/app/shodan_monitor.py): `app/shodan_monitor.py`
- [Paste Leak Monitor](https://github.com/ewanoleghe/cti-lab/blob/main/app/paste_monitor.py): `app/paste_monitor.py`
- [Web Mention Monitor](https://github.com/ewanoleghe/cti-lab/blob/main/app/web_monitor.py): `app/web_monitor.py`
- [Infrastructure Fingerprinting](https://github.com/ewanoleghe/cti-lab/blob/main/app/infra_fingerprinting.py): `app/infra_fingerprinting.py`
- [Runtime Configuration](https://github.com/ewanoleghe/cti-lab/blob/main/app/config.py): `app/config.py`

### Persistence

- [SQLite Articles](https://github.com/ewanoleghe/cti-lab/blob/main/app/database.py): `app/database.py`

### API Service

- [FastAPI Endpoints](https://github.com/ewanoleghe/cti-lab/blob/main/app/api.py): `app/api.py`

### Dashboard

- [Dashboard UI](https://github.com/ewanoleghe/cti-lab/blob/main/ui/src/App.jsx): `ui/src/App.jsx`
- [React Entry](https://github.com/ewanoleghe/cti-lab/blob/main/ui/src/main.jsx): `ui/src/main.jsx`

### Other components

- **CTI Analyst**

## Connections

- CTI Analyst → Dashboard UI: views dashboard (evidence: `README.md`)
- Scheduled Collector → Global CTI Feeds: collects feeds (evidence: `app/collector.py`)
- Scheduled Collector → Phishing Monitor: runs monitor (evidence: `app/collector.py`)
- Scheduled Collector → Breach Monitor: runs monitor (evidence: `app/collector.py`)
- Scheduled Collector → Shodan Exposure: runs monitor (evidence: `app/collector.py`)
- Scheduled Collector → Paste Leak Monitor: runs monitor (evidence: `app/collector.py`)
- Scheduled Collector → Web Mention Monitor: runs monitor (evidence: `app/collector.py`)
- Scheduled Collector → SQLite Articles: writes findings (evidence: `app/collector.py`)
- Scheduled Collector → Runtime Configuration: uses settings (evidence: `app/collector.py`)
- Breach Monitor → SQLite Articles: writes findings (evidence: `app/breach_monitor.py`)
- Breach Monitor → Runtime Configuration: reads settings (evidence: `app/breach_monitor.py`)
- Breach Variant → SQLite Articles: writes findings (evidence: `app/breach_monitor__2.py`)
- Paste Leak Monitor → SQLite Articles: writes findings (evidence: `app/paste_monitor.py`)
- Web Mention Monitor → SQLite Articles: writes mentions (evidence: `app/web_monitor.py`)
- Phishing Monitor → SQLite Articles: writes findings (evidence: `app/phishing_monitor.py`)
- Shodan Exposure → SQLite Articles: writes findings (evidence: `app/shodan_monitor.py`)
- FastAPI Endpoints → SQLite Articles: reads articles (evidence: `app/api.py`)
- FastAPI Endpoints → Runtime Configuration: reads settings (evidence: `app/api.py`)
- Dashboard UI → FastAPI Endpoints: requests data (evidence: `ui/src/App.jsx`)
- React Entry → Dashboard UI: renders (evidence: `ui/src/main.jsx`)