How huxynsys/bruteforceguard works
BruteForceGuard is an authentication-threat monitoring platform: host collectors normalize authentication logs and send events to a FastAPI backend, which detects attack patterns, creates alerts, correlates them into sessions, and enriches risk context. The frontend presents events, alerts, sessions, dashboards, and intelligence details. The README is empty, and several API and service implementations were not sampled; the graph therefore omits uncertain internal wiring while retaining the major product areas indicated by the source tree.
Main entry points: main.py FastAPI application · models.py Event model · pages Analyst pages · client.ts HTTP client
Components 26
Event collection
- Linux SSH parser
collectors/linux/ssh_auth_parser.py - Windows parser
collectors/windows/security_parser.py - JSON collector
collectors/json/json_collector.py - Event model
collectors/common/models.py - Event sender
collectors/common/sender.py
Detection backend
- FastAPI application
backend/app/main.py - Event endpoints
backend/app/api/events.py - Pattern detection
backend/app/services/detection_service.py - Event processing
backend/app/services/event_service.py - Session correlation
backend/app/services/attack_session_service.py - Session lifecycle
backend/app/services/session_service.py - Alert endpoints
backend/app/api/alerts.py - Session endpoints
backend/app/api/attack_sessions.py - Dashboard endpoints
backend/app/api/dashboard.py - Blacklist endpoints
backend/app/api/v1/endpoints/blacklist.py
Threat intelligence
- Enrichment and scoring
backend/app/intelligence/service.py - Local intel provider
backend/app/intelligence/local_provider.py - Indicator repository
backend/app/intelligence/repository.py
Analyst interface
- Frontend routes
frontend/src/App.tsx - Analyst pages
frontend/src/pages - HTTP client
frontend/src/api/client.ts - Session intelligence view
frontend/src/components/sessions/SessionDetails.tsx
Persistent state
- Application database
backend/app/db/database.py - Domain models
backend/app/models
Other components
- Security analyst
- Monitored host
Connections 22
- Monitored host → Linux SSH parser: provides logs
- Linux SSH parser → Event model: produces events
- Windows parser → Event model: produces events
- JSON collector → Event model: produces events
- Event model → Event sender: serializes events
- Event sender → Event endpoints: submits events
- FastAPI application → Event endpoints: mounts router
- FastAPI application → Alert endpoints: mounts router
- FastAPI application → Session endpoints: mounts router
- FastAPI application → Dashboard endpoints: mounts router
- FastAPI application → Blacklist endpoints: mounts router
- Pattern detection → Application database: queries and writes
- Session lifecycle → Application database: reads and writes
- Indicator repository → Application database: reads and writes
- Enrichment and scoring → Local intel provider: looks up indicators
- Enrichment and scoring → Indicator repository: uses indicator storage
- Frontend routes → Analyst pages: routes to
- Analyst pages → HTTP client: requests data
- HTTP client → FastAPI application: calls API
- Analyst pages → Session intelligence view: renders session view
- Session intelligence view → HTTP client: requests intelligence
- Security analyst → Frontend routes: uses interface