# franckferman/cassandracti architecture

> Architecture diagram of the GitHub repository franckferman/cassandracti, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/franckferman/cassandracti
- Repository: https://github.com/franckferman/cassandracti

## Overview

CassandraCTI is an asynchronous cyber-threat-intelligence aggregator. A scheduled or one-shot run loads configured sources, fetches and filters events, deduplicates delivery through SQLite, matches routes, and sends rendered alerts to configured transports; optional dashboard and LLM briefing capabilities extend that flow. The README documents source and transport families beyond the sampled source excerpts, so those subsystems are represented at their supported directory paths without asserting unsampled internal wiring.

Main entry points: [`cassandra_cti/main.py`](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/main.py) (Run orchestrator), [`cassandra_cti/transports`](https://github.com/franckferman/cassandracti/tree/stable/cassandra_cti/transports) (Alert transports), [`cassandra_cti/web/app.py`](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/web/app.py) (Web dashboard), [`cassandra_cti/briefings.py`](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/briefings.py) (Periodic briefings)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Run and configuration"]
  node_cli["CLI<br/>[cli.py]"]
  node_settings["Settings loader<br/>[config.py]"]
  node_runner["Run orchestrator<br/>[main.py]"]
end

subgraph group_collection["Threat collection"]
  node_rss["RSS feeds<br/>[rss.py]"]
  node_ransomware["Ransomware feeds<br/>[ransomware_live.py]"]
  node_other_sources["Other intel sources"]
end

subgraph group_pipeline["Event processing"]
  node_event["CTI events<br/>[models.py]"]
  node_filters["Event filters<br/>[main.py]"]
  node_router["Route matcher<br/>[router.py]"]
  node_store[("SQLite delivery store<br/>[store.py]")]
end

subgraph group_delivery["Alert delivery"]
  node_templates["Message templates"]
  node_transports["Alert transports"]
end

subgraph group_insight["Dashboard and briefings"]
  node_web["Web dashboard<br/>[app.py]"]
  node_dashboard_page["Dashboard interface<br/>[page.py]"]
  node_briefings["Periodic briefings<br/>[briefings.py]"]
  node_llm["LLM provider layer<br/>[llm.py]"]
end

node_operator(("Operator"))
node_intel_services(("Intel providers"))
node_messaging_services(("Messaging services"))
node_dashboard_user(("Dashboard user"))
node_llm_service(("LLM providers"))

node_operator -->|"invokes"| node_cli
node_cli -->|"starts run"| node_runner
node_runner -->|"loads settings"| node_settings
node_runner -->|"fetches"| node_rss
node_runner -->|"fetches"| node_ransomware
node_runner -->|"fetches"| node_other_sources
node_rss -->|"polls feeds"| node_intel_services
node_ransomware -->|"polls trackers"| node_intel_services
node_other_sources -->|"polls sources"| node_intel_services
node_runner -->|"filters events"| node_filters
node_runner -->|"matches events"| node_router
node_filters -->|"produces events"| node_event
node_router -->|"checks delivery"| node_store
node_runner -->|"records delivery"| node_store
node_runner -->|"dispatches alerts"| node_transports
node_transports -->|"renders messages"| node_templates
node_transports -->|"sends alerts"| node_messaging_services
node_runner -.->|"starts dashboard"| node_web
node_web -->|"reads events"| node_store
node_web -->|"serves interface"| node_dashboard_page
node_dashboard_user -->|"views dashboard"| node_web
node_runner -.->|"generates recaps"| node_briefings
node_briefings -.->|"requests summaries"| node_llm
node_llm -.->|"calls provider"| node_llm_service
node_briefings -.->|"sends recaps"| node_transports

click node_cli "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/cli.py"
click node_settings "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/config.py"
click node_runner "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/main.py"
click node_event "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/models.py"
click node_rss "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/sources/rss.py"
click node_ransomware "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/sources/ransomware_live.py"
click node_other_sources "https://github.com/franckferman/cassandracti/tree/stable/cassandra_cti/sources"
click node_filters "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/main.py"
click node_router "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/router.py"
click node_store "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/store.py"
click node_templates "https://github.com/franckferman/cassandracti/tree/stable/templates"
click node_transports "https://github.com/franckferman/cassandracti/tree/stable/cassandra_cti/transports"
click node_web "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/web/app.py"
click node_dashboard_page "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/web/page.py"
click node_briefings "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/briefings.py"
click node_llm "https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/llm.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_settings,node_runner,node_dashboard_user toneBlue
class node_rss,node_ransomware,node_other_sources toneAmber
class node_event,node_filters,node_router,node_store toneMint
class node_templates,node_transports toneRose
class node_web,node_dashboard_page,node_briefings,node_llm,node_operator,node_intel_services,node_messaging_services,node_llm_service toneIndigo
```

## Components

### Run and configuration

- [CLI](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/cli.py): `cassandra_cti/cli.py`
- [Settings loader](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/config.py): `cassandra_cti/config.py`
- [Run orchestrator](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/main.py): `cassandra_cti/main.py`

### Threat collection

- [RSS feeds](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/sources/rss.py): `cassandra_cti/sources/rss.py`
- [Ransomware feeds](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/sources/ransomware_live.py): `cassandra_cti/sources/ransomware_live.py`
- [Other intel sources](https://github.com/franckferman/cassandracti/tree/stable/cassandra_cti/sources): `cassandra_cti/sources`

### Event processing

- [CTI events](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/models.py): `cassandra_cti/models.py`
- [Event filters](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/main.py): `cassandra_cti/main.py`
- [Route matcher](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/router.py): `cassandra_cti/router.py`
- [SQLite delivery store](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/store.py): `cassandra_cti/store.py`

### Alert delivery

- [Message templates](https://github.com/franckferman/cassandracti/tree/stable/templates): `templates`
- [Alert transports](https://github.com/franckferman/cassandracti/tree/stable/cassandra_cti/transports): `cassandra_cti/transports`

### Dashboard and briefings

- [Web dashboard](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/web/app.py): `cassandra_cti/web/app.py`
- [Dashboard interface](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/web/page.py): `cassandra_cti/web/page.py`
- [Periodic briefings](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/briefings.py): `cassandra_cti/briefings.py`
- [LLM provider layer](https://github.com/franckferman/cassandracti/blob/stable/cassandra_cti/llm.py): `cassandra_cti/llm.py`

### Other components

- **Operator**
- **Intel providers**
- **Messaging services**
- **Dashboard user**
- **LLM providers**

## Connections

- Operator → CLI: invokes
- CLI → Run orchestrator: starts run
- Run orchestrator → Settings loader: loads settings
- Run orchestrator → RSS feeds: fetches
- Run orchestrator → Ransomware feeds: fetches
- Run orchestrator → Other intel sources: fetches
- RSS feeds → Intel providers: polls feeds
- Ransomware feeds → Intel providers: polls trackers
- Other intel sources → Intel providers: polls sources
- Run orchestrator → Event filters: filters events
- Run orchestrator → Route matcher: matches events
- Event filters → CTI events: produces events
- Route matcher → SQLite delivery store: checks delivery
- Run orchestrator → SQLite delivery store: records delivery
- Run orchestrator → Alert transports: dispatches alerts
- Alert transports → Message templates: renders messages
- Alert transports → Messaging services: sends alerts
- Run orchestrator → Web dashboard: starts dashboard
- Web dashboard → SQLite delivery store: reads events
- Web dashboard → Dashboard interface: serves interface
- Dashboard user → Web dashboard: views dashboard
- Run orchestrator → Periodic briefings: generates recaps
- Periodic briefings → LLM provider layer: requests summaries
- LLM provider layer → LLM providers: calls provider
- Periodic briefings → Alert transports: sends recaps