# jaopadua/siem-threat-detection-lab architecture

> Architecture diagram of the GitHub repository jaopadua/siem-threat-detection-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jaopadua/siem-threat-detection-lab
- Repository: https://github.com/jaopadua/siem-threat-detection-lab

## Overview

This repository documents a Wazuh security-monitoring lab: endpoint detections and integrity changes are collected and categorized into alerts, with Telegram notifications as a user-facing result. The README also describes Suricata, agent deployment, and a dashboard. No source excerpts were provided, so the graph reflects documented configuration and relationships only; it does not assert undocumented implementation details.

Main entry points: [`README.md`](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md) (Wazuh Manager)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_endpoints["Endpoint Detection"]
  node_clamav["ClamAV Scanning<br/>[README.md]"]
  node_detection_log["Detection Log<br/>[README.md]"]
  node_agent_collection["Agent Collection<br/>[README.md]"]
  node_fim["File Integrity Monitoring<br/>[README.md]"]
  node_suricata["Suricata IDS<br/>[README.md]"]
end

subgraph group_monitoring["Wazuh Monitoring"]
  node_manager["Wazuh Manager<br/>[README.md]"]
  node_custom_rules["Custom Rules<br/>[README.md]"]
  node_dashboard["Agent Dashboard<br/>[README.md]"]
end

subgraph group_notifications["Alert Delivery"]
  node_telegram_integration["Telegram Integration<br/>[README.md]"]
end

node_security_activity(("Security Activity"))
node_telegram(("Telegram Bot"))

node_security_activity -->|"scanned by"| node_clamav
node_clamav -->|"writes detections"| node_detection_log
node_detection_log -->|"read by"| node_agent_collection
node_agent_collection -->|"sends events"| node_manager
node_security_activity -->|"monitored for changes"| node_fim
node_fim -->|"reports changes"| node_manager
node_security_activity -->|"inspected by"| node_suricata
node_manager -->|"evaluates events with"| node_custom_rules
node_custom_rules -->|"categorizes alerts for"| node_telegram_integration
node_telegram_integration -->|"sends notifications"| node_telegram
node_dashboard -->|"deploys agents through"| node_manager

click node_clamav "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"
click node_detection_log "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"
click node_agent_collection "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"
click node_fim "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"
click node_suricata "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"
click node_manager "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"
click node_custom_rules "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"
click node_dashboard "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"
click node_telegram_integration "https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_clamav,node_detection_log,node_agent_collection,node_fim,node_suricata toneBlue
class node_manager,node_custom_rules,node_dashboard toneAmber
class node_telegram_integration toneMint
class node_security_activity,node_telegram toneIndigo
```

## Components

### Endpoint Detection

- [ClamAV Scanning](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`
- [Detection Log](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`
- [Agent Collection](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`
- [File Integrity Monitoring](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`
- [Suricata IDS](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`

### Wazuh Monitoring

- [Wazuh Manager](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`
- [Custom Rules](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`
- [Agent Dashboard](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`

### Alert Delivery

- [Telegram Integration](https://github.com/jaopadua/siem-threat-detection-lab/blob/master/README.md): `README.md`

### Other components

- **Security Activity**
- **Telegram Bot**

## Connections

- Security Activity → ClamAV Scanning: scanned by (evidence: `README.md`)
- ClamAV Scanning → Detection Log: writes detections (evidence: `README.md`)
- Detection Log → Agent Collection: read by (evidence: `README.md`)
- Agent Collection → Wazuh Manager: sends events (evidence: `README.md`)
- Security Activity → File Integrity Monitoring: monitored for changes (evidence: `README.md`)
- File Integrity Monitoring → Wazuh Manager: reports changes (evidence: `README.md`)
- Security Activity → Suricata IDS: inspected by (evidence: `README.md`)
- Wazuh Manager → Custom Rules: evaluates events with (evidence: `README.md`)
- Custom Rules → Telegram Integration: categorizes alerts for (evidence: `README.md`)
- Telegram Integration → Telegram Bot: sends notifications (evidence: `README.md`)
- Agent Dashboard → Wazuh Manager: deploys agents through (evidence: `README.md`)