How fable-for-four/chimera works
Chimera is a simulated-log investigation product: analysts start an investigation, inspect an explainable attack chain and cited evidence, review uncertainty and stress-test results, then approve recommended responses. The Python engine reconstructs the case; FastAPI serves case data and records approvals, while the Next.js client presents the investigation. The README documents the generator-to-engine and browser-to-API flows. Some subsystem links below rely on that documentation or the SOURCE INDEX; unsampled implementations are represented at their existing directory paths.
Main entry points: run.py Investigation runner · state.tsx Client state and API · main.py FastAPI service · sort.py Time ordering
Components 32
Scenario generation
- Scenario generator
generator/scenario.py - Normal log noise
generator/noise.py
Investigation engine
- Investigation runner
engine/run.py - Event intake
engine/intake.py - Time ordering
engine/sort.py - Behavior profiles
engine/profile.py - Deviation scoring
engine/score.py - Signal linking
engine/link.py - Chain challenge
engine/challenge.py - Verdict and impact
engine/verdict.py - Cited report
engine/report.py - Stress testing
engine/stress.py - Truth evaluation
engine/truth.py
API and persistence
- Log file parser
api/parse_logs.py - FastAPI service
api/main.py - Authentication
api/auth.py - Accounts and approvals
api/db.py - Generated case files
api/case_files.py - Verification email
api/email.py
Investigation interface
- Client state and API
web/lib/state.tsx - Start investigation
web/components/Start.tsx - Case overview
web/components/Overview.tsx - Attack graph
web/components/AttackGraph.tsx - Evidence views
web/components/EvidenceDrawer.tsx - Forensic event log
web/components/EvidenceLog.tsx - Incident report
web/components/IncidentReport.tsx - Stress lab
web/components/StressLab.tsx - User administration
web/app/admin/page.tsx - Sign-in and signup
web/app/login/page.tsx - Data contracts
web/lib/types.ts
Other components
- Analyst
- Browser
Connections 44
- Scenario generator → Normal log noise: adds normal events
generator/noise.py - Scenario generator → Investigation runner: produces scenario data
README.md - Investigation runner → Event intake: runs stage
engine/run.py - Investigation runner → Time ordering: runs stage
engine/run.py - Investigation runner → Behavior profiles: runs stage
engine/run.py - Investigation runner → Deviation scoring: runs stage
engine/run.py - Investigation runner → Signal linking: runs stage
engine/run.py - Investigation runner → Chain challenge: runs stage
engine/run.py - Investigation runner → Verdict and impact: runs stage
engine/run.py - Investigation runner → Cited report: builds report
engine/run.py - Investigation runner → Stress testing: runs stress tests
engine/run.py - Investigation runner → Truth evaluation: evaluates truth
engine/run.py - Signal linking → Time ordering: parses event times
engine/link.py - Deviation scoring → Time ordering: uses time parsing
engine/score.py - Stress testing → Time ordering: uses time parsing
engine/stress.py - Verdict and impact → Signal linking: uses linked chain
engine/verdict.py - Verdict and impact → Time ordering: uses time parsing
engine/verdict.py - Cited report → Chain challenge: uses challenge results
engine/report.py - Cited report → Signal linking: uses linked chain
engine/report.py - Investigation runner → Generated case files: writes case outputs
README.md - Log file parser → Event intake: normalizes log files
- Browser → Sign-in and signup: signs in
web/app/login/page.tsx - Sign-in and signup → FastAPI service: auth requests
web/app/login/page.tsx - Browser → Start investigation: starts investigation
- Start investigation → Client state and API: requests run
web/lib/state.tsx - Client state and API → FastAPI service: calls same-origin API
- FastAPI service → Investigation runner: runs investigation
README.md - FastAPI service → Generated case files: reads case outputs
api/main.py - FastAPI service → Authentication: checks identity
api/main.py - FastAPI service → Accounts and approvals: stores approvals
api/main.py - Authentication → Accounts and approvals: queries users
api/auth.py - FastAPI service → Verification email: sends verification
api/main.py - Client state and API → Case overview: supplies case state
web/components/Overview.tsx - Client state and API → Attack graph: supplies case state
web/components/AttackGraph.tsx - Client state and API → Evidence views: supplies evidence
web/components/EvidenceDrawer.tsx - Client state and API → Forensic event log: supplies events
web/components/EvidenceLog.tsx - Client state and API → Incident report: supplies report
web/components/IncidentReport.tsx - Client state and API → Stress lab: loads stress cases
web/components/StressLab.tsx - Case overview → Attack graph: shows attack path
- Case overview → Evidence views: selects evidence
- Case overview → FastAPI service: approves response
- User administration → FastAPI service: manages users
api/main.py - Client state and API → Data contracts: uses contracts
web/lib/state.tsx - Browser → Incident report: reviews report