# hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters architecture

> Architecture diagram of the GitHub repository hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters
- Repository: https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters

## Overview

CHITRAGUPT is a cyber-forensics investigation framework: an investigator selects a case, uploads CSV or Windows Event XML evidence, and uses the dashboard to review events, anomalies, findings, and reports. The documented investigation stages include parsing and normalization, evidence storage, search, feature extraction, detection, correlation, inference, and reporting. Sampled code confirms ingestion formats, pipeline orchestration, and evidence integrity checks; unsampled endpoint internals and several documented capabilities are represented at the subsystem level, with uncertain wiring omitted.

Main entry points: [`backend/app/pipeline.py`](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/pipeline.py) (Pipeline Orchestrator), [`backend/app/main.py`](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/main.py) (FastAPI API), [`backend/app/database.py`](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/database.py) (Database Sessions), [`frontend/src/App.jsx`](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/frontend/src/App.jsx) (Investigation Dashboard)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_intake["Evidence Intake"]
  node_csv_ingest["CSV Ingestion<br/>[ingestion.py]"]
  node_xml_ingest["Windows XML Ingestion"]
  node_evidence_storage["Evidence Integrity"]
end

subgraph group_analysis["Investigation Analysis"]
  node_pipeline["Pipeline Orchestrator<br/>[pipeline.py]"]
  node_features["Feature Extraction<br/>[features.py]"]
  node_rules["Scenario Rules<br/>[rules.py]"]
  node_isolation["Isolation Forest<br/>[anomaly.py]"]
  node_lof["Local Outlier Factor<br/>[lof.py]"]
  node_correlation["Event Correlation<br/>[correlation.py]"]
  node_inference["Finding Inference<br/>[inference.py]"]
end

subgraph group_service["API and Persistence"]
  node_api["FastAPI API<br/>[main.py]"]
  node_database_config["Database Sessions<br/>[database.py]"]
  node_models["Case and Event Models<br/>[models.py]"]
end

subgraph group_review["Investigation Review"]
  node_dashboard["Investigation Dashboard<br/>[App.jsx]"]
  node_app_mount["React Entry<br/>[main.jsx]"]
  node_reporting["Report Generation<br/>[reporting.py]"]
end

node_investigator(("Investigator"))
node_ollama["Ollama Service"]
node_postgres[("PostgreSQL")]

node_investigator -->|"uses"| node_dashboard
node_app_mount -->|"renders"| node_dashboard
node_dashboard -->|"HTTP requests"| node_api
node_api -->|"parses CSV"| node_csv_ingest
node_api -->|"parses XML"| node_xml_ingest
node_api -->|"retains or verifies"| node_evidence_storage
node_api -->|"starts analysis"| node_pipeline
node_pipeline -->|"extracts features"| node_features
node_pipeline -->|"evaluates rules"| node_rules
node_pipeline -->|"detects anomalies"| node_isolation
node_pipeline -->|"detects anomalies"| node_lof
node_pipeline -->|"correlates events"| node_correlation
node_pipeline -->|"infers findings"| node_inference
node_api -->|"generates reports"| node_reporting
node_api -.->|"requests explanation"| node_ollama
node_api -->|"opens sessions"| node_database_config
node_pipeline -->|"loads case events"| node_database_config
node_evidence_storage -->|"loads evidence hash"| node_database_config
node_database_config -->|"queries and persists"| node_postgres
node_models -->|"maps records"| node_postgres

click node_dashboard "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/frontend/src/App.jsx"
click node_app_mount "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/frontend/src/main.jsx"
click node_api "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/main.py"
click node_csv_ingest "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/ingestion.py"
click node_xml_ingest "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/windows_event_ingestion.py"
click node_evidence_storage "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/evidence_storage.py"
click node_pipeline "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/pipeline.py"
click node_features "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/features.py"
click node_rules "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/rules.py"
click node_isolation "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/anomaly.py"
click node_lof "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/lof.py"
click node_correlation "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/correlation.py"
click node_inference "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/inference.py"
click node_reporting "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/reporting.py"
click node_database_config "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/database.py"
click node_models "https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/models.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_csv_ingest,node_xml_ingest,node_evidence_storage toneBlue
class node_pipeline,node_features,node_rules,node_isolation,node_lof,node_correlation,node_inference,node_postgres toneAmber
class node_api,node_database_config,node_models toneMint
class node_dashboard,node_app_mount,node_reporting toneRose
class node_investigator,node_ollama toneIndigo
```

## Components

### Evidence Intake

- [CSV Ingestion](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/ingestion.py): `backend/app/ingestion.py`
- [Windows XML Ingestion](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/windows_event_ingestion.py): `backend/app/windows_event_ingestion.py`
- [Evidence Integrity](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/evidence_storage.py): `backend/app/evidence_storage.py`

### Investigation Analysis

- [Pipeline Orchestrator](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/pipeline.py): `backend/app/pipeline.py`
- [Feature Extraction](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/features.py): `backend/app/features.py`
- [Scenario Rules](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/rules.py): `backend/app/rules.py`
- [Isolation Forest](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/anomaly.py): `backend/app/anomaly.py`
- [Local Outlier Factor](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/lof.py): `backend/app/lof.py`
- [Event Correlation](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/correlation.py): `backend/app/correlation.py`
- [Finding Inference](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/inference.py): `backend/app/inference.py`

### API and Persistence

- [FastAPI API](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/main.py): `backend/app/main.py`
- [Database Sessions](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/database.py): `backend/app/database.py`
- [Case and Event Models](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/models.py): `backend/app/models.py`

### Investigation Review

- [Investigation Dashboard](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [React Entry](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/frontend/src/main.jsx): `frontend/src/main.jsx`
- [Report Generation](https://github.com/hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters/blob/main/backend/app/reporting.py): `backend/app/reporting.py`

### Other components

- **Investigator**
- **Ollama Service**
- **PostgreSQL**

## Connections

- Investigator → Investigation Dashboard: uses
- React Entry → Investigation Dashboard: renders
- Investigation Dashboard → FastAPI API: HTTP requests
- FastAPI API → CSV Ingestion: parses CSV
- FastAPI API → Windows XML Ingestion: parses XML
- FastAPI API → Evidence Integrity: retains or verifies
- FastAPI API → Pipeline Orchestrator: starts analysis
- Pipeline Orchestrator → Feature Extraction: extracts features
- Pipeline Orchestrator → Scenario Rules: evaluates rules
- Pipeline Orchestrator → Isolation Forest: detects anomalies
- Pipeline Orchestrator → Local Outlier Factor: detects anomalies
- Pipeline Orchestrator → Event Correlation: correlates events
- Pipeline Orchestrator → Finding Inference: infers findings
- FastAPI API → Report Generation: generates reports
- FastAPI API → Ollama Service: requests explanation
- FastAPI API → Database Sessions: opens sessions
- Pipeline Orchestrator → Database Sessions: loads case events
- Evidence Integrity → Database Sessions: loads evidence hash
- Database Sessions → PostgreSQL: queries and persists
- Case and Event Models → PostgreSQL: maps records