franckferman/cassandracti

How franckferman/cassandracti works

CassandraCTI is an asynchronous cyber-threat-intelligence aggregator. A scheduled or one-shot run loads configured sources, fetches and filters events, deduplicates delivery through SQLite, matches routes, and sends rendered alerts to configured transports; optional dashboard and LLM briefing capabilities extend that flow. The README documents source and transport families beyond the sampled source excerpts, so those subsystems are represented at their supported directory paths without asserting unsampled internal wiring.

Main entry points: main.py Run orchestrator · transports Alert transports · app.py Web dashboard · briefings.py Periodic briefings

Components 21

Run and configuration

CLI cassandra_cti/cli.py
Settings loader cassandra_cti/config.py
Run orchestrator cassandra_cti/main.py

Threat collection

RSS feeds cassandra_cti/sources/rss.py
Ransomware feeds cassandra_cti/sources/ransomware_live.py
Other intel sources cassandra_cti/sources

Event processing

CTI events cassandra_cti/models.py
Event filters cassandra_cti/main.py
Route matcher cassandra_cti/router.py
SQLite delivery store cassandra_cti/store.py

Alert delivery

Message templates templates
Alert transports cassandra_cti/transports

Dashboard and briefings

Web dashboard cassandra_cti/web/app.py
Dashboard interface cassandra_cti/web/page.py
Periodic briefings cassandra_cti/briefings.py
LLM provider layer cassandra_cti/llm.py

Other components

Operator
Intel providers
Messaging services
Dashboard user
LLM providers

Connections 25

Operator → CLI: invokes
CLI → Run orchestrator: starts run
Run orchestrator → Settings loader: loads settings
Run orchestrator → RSS feeds: fetches
Run orchestrator → Ransomware feeds: fetches
Run orchestrator → Other intel sources: fetches
RSS feeds → Intel providers: polls feeds
Ransomware feeds → Intel providers: polls trackers
Other intel sources → Intel providers: polls sources
Run orchestrator → Event filters: filters events
Run orchestrator → Route matcher: matches events
Event filters → CTI events: produces events
Route matcher → SQLite delivery store: checks delivery
Run orchestrator → SQLite delivery store: records delivery
Run orchestrator → Alert transports: dispatches alerts
Alert transports → Message templates: renders messages
Alert transports → Messaging services: sends alerts
Run orchestrator → Web dashboard: starts dashboard
Web dashboard → SQLite delivery store: reads events
Web dashboard → Dashboard interface: serves interface
Dashboard user → Web dashboard: views dashboard
Run orchestrator → Periodic briefings: generates recaps
Periodic briefings → LLM provider layer: requests summaries
LLM provider layer → LLM providers: calls provider
Periodic briefings → Alert transports: sends recaps

Drawn by GitDiagram on September 28, 2026 from the repository's file tree, README and source files. Read as Markdown ·