# fareedfauzi/mantis architecture

> Architecture diagram of the GitHub repository fareedfauzi/mantis, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/fareedfauzi/mantis
- Repository: https://github.com/fareedfauzi/mantis

## Overview

MANTIS is a local-first threat-intelligence workbench. An analyst searches an IOC or starts a workbench in the frontend; the backend routes the request to enrichment, local intelligence, or analysis services, and MANTIS AI can use collected evidence to support investigations and reporting. The graph preserves the README’s major workbench and monitoring branches. Edges cite the README or shown import/reference evidence; dashed links mark relationships whose implementation was not sampled.

Main entry points: [`backend/main.py`](https://github.com/fareedfauzi/mantis/blob/main/backend/main.py) (API routes), [`backend/cti_query.py`](https://github.com/fareedfauzi/mantis/blob/main/backend/cti_query.py) (CTI articles), [`backend/ai_service.py`](https://github.com/fareedfauzi/mantis/blob/main/backend/ai_service.py) (AI investigations), [`backend/agent_tools/registry.py`](https://github.com/fareedfauzi/mantis/blob/main/backend/agent_tools/registry.py) (Agent tools)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_experience["Analyst experience"]
  node_frontend["MANTIS interface<br/>[app.js]"]
  node_ai_ui["AI panel<br/>[ai.js]"]
  node_binary_ui["Binary Lab UI<br/>[binary-lab.js]"]
  node_infra_ui["Infra Hunt UI<br/>[infra-hunt.js]"]
  node_similarity_ui["Similarity UI<br/>[similarity.js]"]
  node_api["API routes<br/>[main.py]"]
end

subgraph group_investigation["IOC and investigations"]
  node_ioc["IOC enrichment<br/>[intel_query.py]"]
  node_infra["Infrastructure hunting"]
  node_ai_service["AI investigations<br/>[ai_service.py]"]
  node_ai_case[("Evidence cases<br/>[ai_case_service.py]")]
  node_agent_tools["Agent tools<br/>[registry.py]"]
end

subgraph group_knowledge["Threat knowledge"]
  node_cti["CTI articles<br/>[cti_query.py]"]
  node_cti_store[("CTI corpus<br/>[cti_db.py]")]
  node_misp["MISP knowledge<br/>[misp_galaxy.py]"]
end

subgraph group_analysis["Malware workbenches"]
  node_binary["Binary analysis<br/>[binary_lab.py]"]
  node_binary_runner["Headless analysis<br/>[runner.py]"]
  node_genesect["IDA investigation<br/>[handlers.py]"]
  node_similarity["Sample similarity"]
  node_yara["YARA operations<br/>[yara_service.py]"]
  node_yara_engine["YARA engine<br/>[yara_engine.py]"]
end

subgraph group_monitoring["Collection and monitoring"]
  node_breach["Breach monitoring<br/>[breach_watcher.py]"]
  node_feeds[("CTI feed intake<br/>[feed_intel.py]")]
  node_ransomware["Ransomware monitor"]
  node_telegram["Telegram toolkit"]
  node_xmonitor["X monitoring<br/>[x_monitor.py]"]
  node_daily["Daily intelligence"]
end

node_analyst(("Analyst"))
node_providers{{"Intel providers"}}
node_localdata[("Local intelligence")]

node_analyst -->|"uses"| node_frontend
node_frontend -->|"submits searches"| node_api
node_ai_ui -->|"requests AI"| node_api
node_binary_ui -->|"opens workbench"| node_api
node_infra_ui -->|"starts hunts"| node_api
node_similarity_ui -->|"compares samples"| node_api
node_api -->|"routes enrichment"| node_ioc
node_api -->|"routes AI"| node_ai_service
node_api -->|"runs cases"| node_ai_case
node_api -->|"mounts routes"| node_agent_tools
node_api -->|"routes hunts"| node_infra
node_api -->|"routes analysis"| node_binary
node_api -->|"routes comparisons"| node_similarity
node_api -->|"routes YARA"| node_yara
node_api -->|"routes article search"| node_cti
node_cti -->|"queries corpus"| node_cti_store
node_api -->|"serves knowledge"| node_misp
node_ai_service -->|"uses enrichment"| node_ioc
node_ai_service -->|"uses article search"| node_cti
node_ai_service -->|"uses threat knowledge"| node_misp
node_agent_tools -->|"looks up indicators"| node_ioc
node_agent_tools -->|"extracts article IOCs"| node_cti
node_agent_tools -->|"uses case tools"| node_ai_case
node_yara -->|"compiles and scans"| node_yara_engine
node_binary -.->|"runs analysis"| node_binary_runner
node_binary_runner -.->|"uses IDA tools"| node_genesect
node_binary_runner -->|"writes reports"| node_localdata
node_ioc -->|"queries sources"| node_providers
node_infra -->|"cross-references"| node_providers
node_feeds -.->|"feeds corpus"| node_cti_store
node_api -.->|"serves monitoring"| node_breach
node_api -.->|"serves monitoring"| node_ransomware
node_api -.->|"serves toolkit"| node_telegram
node_api -.->|"serves monitoring"| node_xmonitor
node_api -.->|"serves rollup"| node_daily
node_daily -.->|"includes articles"| node_cti
node_daily -.->|"includes signals"| node_breach

click node_frontend "https://github.com/fareedfauzi/mantis/blob/main/frontend/app.js"
click node_ai_ui "https://github.com/fareedfauzi/mantis/blob/main/frontend/ai.js"
click node_binary_ui "https://github.com/fareedfauzi/mantis/blob/main/frontend/binary-lab.js"
click node_infra_ui "https://github.com/fareedfauzi/mantis/blob/main/frontend/infra-hunt.js"
click node_similarity_ui "https://github.com/fareedfauzi/mantis/blob/main/frontend/similarity.js"
click node_api "https://github.com/fareedfauzi/mantis/blob/main/backend/main.py"
click node_ioc "https://github.com/fareedfauzi/mantis/blob/main/backend/intel_query.py"
click node_infra "https://github.com/fareedfauzi/mantis/blob/main/backend/infra_hunt_service.py"
click node_ai_service "https://github.com/fareedfauzi/mantis/blob/main/backend/ai_service.py"
click node_ai_case "https://github.com/fareedfauzi/mantis/blob/main/backend/ai_case_service.py"
click node_agent_tools "https://github.com/fareedfauzi/mantis/blob/main/backend/agent_tools/registry.py"
click node_cti "https://github.com/fareedfauzi/mantis/blob/main/backend/cti_query.py"
click node_cti_store "https://github.com/fareedfauzi/mantis/blob/main/backend/cti_db.py"
click node_misp "https://github.com/fareedfauzi/mantis/blob/main/backend/misp_galaxy.py"
click node_binary "https://github.com/fareedfauzi/mantis/blob/main/backend/binary_lab.py"
click node_binary_runner "https://github.com/fareedfauzi/mantis/blob/main/backend/omni_idb/runner.py"
click node_genesect "https://github.com/fareedfauzi/mantis/blob/main/backend/omni_runtime/genesect/handlers.py"
click node_similarity "https://github.com/fareedfauzi/mantis/blob/main/backend/similarity_service.py"
click node_yara "https://github.com/fareedfauzi/mantis/blob/main/backend/yara_service.py"
click node_yara_engine "https://github.com/fareedfauzi/mantis/blob/main/backend/yara_engine.py"
click node_breach "https://github.com/fareedfauzi/mantis/blob/main/backend/breach_watcher.py"
click node_feeds "https://github.com/fareedfauzi/mantis/blob/main/backend/feed_intel.py"
click node_ransomware "https://github.com/fareedfauzi/mantis/blob/main/backend/ransomware_monitor.py"
click node_telegram "https://github.com/fareedfauzi/mantis/blob/main/backend/tg_channel_monitor.py"
click node_xmonitor "https://github.com/fareedfauzi/mantis/blob/main/backend/x_monitor.py"
click node_daily "https://github.com/fareedfauzi/mantis/blob/main/backend/todays_intelligence.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_frontend,node_ai_ui,node_binary_ui,node_infra_ui,node_similarity_ui,node_api toneBlue
class node_ioc,node_infra,node_ai_service,node_ai_case,node_agent_tools,node_localdata toneAmber
class node_cti,node_cti_store,node_misp toneMint
class node_binary,node_binary_runner,node_genesect,node_similarity,node_yara,node_yara_engine toneRose
class node_breach,node_feeds,node_ransomware,node_telegram,node_xmonitor,node_daily,node_analyst,node_providers toneIndigo
```

## Components

### Analyst experience

- [MANTIS interface](https://github.com/fareedfauzi/mantis/blob/main/frontend/app.js): `frontend/app.js`
- [AI panel](https://github.com/fareedfauzi/mantis/blob/main/frontend/ai.js): `frontend/ai.js`
- [Binary Lab UI](https://github.com/fareedfauzi/mantis/blob/main/frontend/binary-lab.js): `frontend/binary-lab.js`
- [Infra Hunt UI](https://github.com/fareedfauzi/mantis/blob/main/frontend/infra-hunt.js): `frontend/infra-hunt.js`
- [Similarity UI](https://github.com/fareedfauzi/mantis/blob/main/frontend/similarity.js): `frontend/similarity.js`
- [API routes](https://github.com/fareedfauzi/mantis/blob/main/backend/main.py): `backend/main.py`

### IOC and investigations

- [IOC enrichment](https://github.com/fareedfauzi/mantis/blob/main/backend/intel_query.py): `backend/intel_query.py`
- [Infrastructure hunting](https://github.com/fareedfauzi/mantis/blob/main/backend/infra_hunt_service.py): `backend/infra_hunt_service.py`
- [AI investigations](https://github.com/fareedfauzi/mantis/blob/main/backend/ai_service.py): `backend/ai_service.py`
- [Evidence cases](https://github.com/fareedfauzi/mantis/blob/main/backend/ai_case_service.py): `backend/ai_case_service.py`
- [Agent tools](https://github.com/fareedfauzi/mantis/blob/main/backend/agent_tools/registry.py): `backend/agent_tools/registry.py`

### Threat knowledge

- [CTI articles](https://github.com/fareedfauzi/mantis/blob/main/backend/cti_query.py): `backend/cti_query.py`
- [CTI corpus](https://github.com/fareedfauzi/mantis/blob/main/backend/cti_db.py): `backend/cti_db.py`
- [MISP knowledge](https://github.com/fareedfauzi/mantis/blob/main/backend/misp_galaxy.py): `backend/misp_galaxy.py`

### Malware workbenches

- [Binary analysis](https://github.com/fareedfauzi/mantis/blob/main/backend/binary_lab.py): `backend/binary_lab.py`
- [Headless analysis](https://github.com/fareedfauzi/mantis/blob/main/backend/omni_idb/runner.py): `backend/omni_idb/runner.py`
- [IDA investigation](https://github.com/fareedfauzi/mantis/blob/main/backend/omni_runtime/genesect/handlers.py): `backend/omni_runtime/genesect/handlers.py`
- [Sample similarity](https://github.com/fareedfauzi/mantis/blob/main/backend/similarity_service.py): `backend/similarity_service.py`
- [YARA operations](https://github.com/fareedfauzi/mantis/blob/main/backend/yara_service.py): `backend/yara_service.py`
- [YARA engine](https://github.com/fareedfauzi/mantis/blob/main/backend/yara_engine.py): `backend/yara_engine.py`

### Collection and monitoring

- [Breach monitoring](https://github.com/fareedfauzi/mantis/blob/main/backend/breach_watcher.py): `backend/breach_watcher.py`
- [CTI feed intake](https://github.com/fareedfauzi/mantis/blob/main/backend/feed_intel.py): `backend/feed_intel.py`
- [Ransomware monitor](https://github.com/fareedfauzi/mantis/blob/main/backend/ransomware_monitor.py): `backend/ransomware_monitor.py`
- [Telegram toolkit](https://github.com/fareedfauzi/mantis/blob/main/backend/tg_channel_monitor.py): `backend/tg_channel_monitor.py`
- [X monitoring](https://github.com/fareedfauzi/mantis/blob/main/backend/x_monitor.py): `backend/x_monitor.py`
- [Daily intelligence](https://github.com/fareedfauzi/mantis/blob/main/backend/todays_intelligence.py): `backend/todays_intelligence.py`

### Other components

- **Analyst**
- **Intel providers**
- **Local intelligence**

## Connections

- Analyst → MANTIS interface: uses
- MANTIS interface → API routes: submits searches
- AI panel → API routes: requests AI
- Binary Lab UI → API routes: opens workbench
- Infra Hunt UI → API routes: starts hunts
- Similarity UI → API routes: compares samples
- API routes → IOC enrichment: routes enrichment (evidence: `backend/main.py`)
- API routes → AI investigations: routes AI (evidence: `backend/main.py`)
- API routes → Evidence cases: runs cases (evidence: `backend/main.py`)
- API routes → Agent tools: mounts routes (evidence: `backend/main.py`)
- API routes → Infrastructure hunting: routes hunts (evidence: `backend/main.py`)
- API routes → Binary analysis: routes analysis (evidence: `backend/main.py`)
- API routes → Sample similarity: routes comparisons (evidence: `backend/main.py`)
- API routes → YARA operations: routes YARA (evidence: `backend/main.py`)
- API routes → CTI articles: routes article search (evidence: `backend/main.py`)
- CTI articles → CTI corpus: queries corpus (evidence: `backend/cti_query.py`)
- API routes → MISP knowledge: serves knowledge (evidence: `backend/main.py`)
- AI investigations → IOC enrichment: uses enrichment (evidence: `backend/ai_service.py`)
- AI investigations → CTI articles: uses article search (evidence: `backend/ai_service.py`)
- AI investigations → MISP knowledge: uses threat knowledge (evidence: `backend/ai_service.py`)
- Agent tools → IOC enrichment: looks up indicators (evidence: `backend/agent_tools/registry.py`)
- Agent tools → CTI articles: extracts article IOCs (evidence: `backend/agent_tools/registry.py`)
- Agent tools → Evidence cases: uses case tools (evidence: `backend/agent_tools/registry.py`)
- YARA operations → YARA engine: compiles and scans (evidence: `backend/yara_service.py`)
- Binary analysis → Headless analysis: runs analysis
- Headless analysis → IDA investigation: uses IDA tools
- Headless analysis → Local intelligence: writes reports (evidence: `backend/omni_idb/runner.py`)
- IOC enrichment → Intel providers: queries sources
- Infrastructure hunting → Intel providers: cross-references
- CTI feed intake → CTI corpus: feeds corpus
- API routes → Breach monitoring: serves monitoring (evidence: `backend/main.py`)
- API routes → Ransomware monitor: serves monitoring (evidence: `backend/main.py`)
- API routes → Telegram toolkit: serves toolkit (evidence: `backend/main.py`)
- API routes → X monitoring: serves monitoring (evidence: `backend/main.py`)
- API routes → Daily intelligence: serves rollup (evidence: `backend/main.py`)
- Daily intelligence → CTI articles: includes articles
- Daily intelligence → Breach monitoring: includes signals