# joasasantos/neuropurple architecture

> Architecture diagram of the GitHub repository joasasantos/neuropurple, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/joasasantos/neuropurple
- Repository: https://github.com/joasasantos/neuropurple

## Overview

NeuroPurple is an autonomous SOC and purple-team engine, exposed through a conversational CLI. Its investigation workflow normalizes local or connected telemetry, extracts and enriches indicators, analyzes and hunts for evidence, verifies findings, and reports results. A parallel purple-team loop emulates ATT&CK techniques, checks detection coverage, and develops detection rules; SOAR adds analyst-approved response actions. The graph follows documented workflows and sampled calls; several README capabilities have no sampled implementation path or wiring, so their links are not asserted.

Main entry points: [`crates/harness/src/orchestrate.rs`](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/orchestrate.rs) (N1 Investigation), [`app/src/repl.rs`](https://github.com/joasasantos/neuropurple/blob/main/app/src/repl.rs) (Conversational REPL), [`crates/harness/src/purple.rs`](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/purple.rs) (Purple Loop), [`crates/harness/src/hunt.rs`](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/hunt.rs) (Threat Hunting)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["User Interface"]
  node_cli["CLI Entry<br/>[main.rs]"]
  node_repl["Conversational REPL<br/>[repl.rs]"]
end

subgraph group_investigation["Investigation"]
  node_orchestrator["N1 Investigation<br/>[orchestrate.rs]"]
  node_sources["Telemetry Sources<br/>[sources.rs]"]
  node_connectors["SIEM Connectors<br/>[connectors.rs]"]
  node_ioc["IOC Extraction<br/>[ioc.rs]"]
  node_intel["Threat Intel<br/>[intel.rs]"]
  node_analysis["Log Analysis<br/>[analyze.rs]"]
  node_hunt["Threat Hunting<br/>[hunt.rs]"]
  node_triage["N1 Triage<br/>[triage.rs]"]
  node_incident["Incident Reports<br/>[incident.rs]"]
  node_report["Report Export<br/>[report.rs]"]
end

subgraph group_purple["Purple Team"]
  node_purple_loop["Purple Loop<br/>[purple.rs]"]
  node_emulate["BAS Emulation<br/>[emulate.rs]"]
  node_detection["Detection Rules<br/>[detection.rs]"]
  node_coverage["Coverage Graph<br/>[coverage.rs]"]
  node_rl["Reward Learning<br/>[rl.rs]"]
end

subgraph group_response["Response Operations"]
  node_soar["Approved SOAR<br/>[soar.rs]"]
  node_guardrails["Action Guardrails<br/>[guardrails.rs]"]
  node_sinks["Response Sinks<br/>[sink.rs]"]
end

subgraph group_platform["Shared Services"]
  node_agents["Operator Library<br/>[agents.rs]"]
  node_models["Model Pool<br/>[pool.rs]"]
  node_dashboard["Results Dashboard<br/>[dashboard.rs]"]
  node_scheduler["Cron Scheduler<br/>[cron.rs]"]
  node_on_target["On-Target Agents<br/>[agentgen.rs]"]
end

node_analyst(("Analyst"))

node_analyst -->|"starts"| node_cli
node_cli -->|"opens"| node_repl
node_repl -->|"requests investigation"| node_orchestrator
node_orchestrator -->|"ingests"| node_sources
node_sources -->|"queries live sources"| node_connectors
node_orchestrator -->|"enriches indicators"| node_intel
node_orchestrator -->|"runs analysis"| node_analysis
node_orchestrator -->|"runs hunt"| node_hunt
node_orchestrator -->|"records findings"| node_incident
node_orchestrator -->|"produces report"| node_report
node_analysis -->|"extracts indicators"| node_ioc
node_hunt -->|"pivots on indicators"| node_ioc
node_hunt -->|"searches pivots"| node_sources
node_repl -->|"routes triage"| node_triage
node_repl -->|"starts purple loop"| node_purple_loop
node_purple_loop -->|"runs technique"| node_emulate
node_purple_loop -->|"probes detections"| node_connectors
node_purple_loop -->|"authors rules"| node_detection
node_purple_loop -->|"updates coverage"| node_coverage
node_purple_loop -->|"updates reward"| node_rl
node_repl -->|"requests response"| node_soar
node_soar -->|"checks actions"| node_guardrails
node_soar -->|"dispatches approved actions"| node_sinks
node_orchestrator -->|"uses operators"| node_agents
node_orchestrator -->|"requests model output"| node_models
node_repl -->|"opens dashboard"| node_dashboard
node_repl -->|"schedules commands"| node_scheduler
node_repl -->|"generates agents"| node_on_target

click node_cli "https://github.com/joasasantos/neuropurple/blob/main/app/src/main.rs"
click node_repl "https://github.com/joasasantos/neuropurple/blob/main/app/src/repl.rs"
click node_orchestrator "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/orchestrate.rs"
click node_sources "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/sources.rs"
click node_connectors "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/connectors.rs"
click node_ioc "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/ioc.rs"
click node_intel "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/intel.rs"
click node_analysis "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/analyze.rs"
click node_hunt "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/hunt.rs"
click node_triage "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/triage.rs"
click node_incident "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/incident.rs"
click node_report "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/report.rs"
click node_purple_loop "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/purple.rs"
click node_emulate "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/emulate.rs"
click node_detection "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/detection.rs"
click node_coverage "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/coverage.rs"
click node_rl "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/rl.rs"
click node_soar "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/soar.rs"
click node_guardrails "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/guardrails.rs"
click node_sinks "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/sink.rs"
click node_agents "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/agents.rs"
click node_models "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/pool.rs"
click node_dashboard "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/dashboard.rs"
click node_scheduler "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/cron.rs"
click node_on_target "https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/agentgen.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_repl toneBlue
class node_orchestrator,node_sources,node_connectors,node_ioc,node_intel,node_analysis,node_hunt,node_triage,node_incident,node_report toneAmber
class node_purple_loop,node_emulate,node_detection,node_coverage,node_rl toneMint
class node_soar,node_guardrails,node_sinks toneRose
class node_agents,node_models,node_dashboard,node_scheduler,node_on_target,node_analyst toneIndigo
```

## Components

### User Interface

- [CLI Entry](https://github.com/joasasantos/neuropurple/blob/main/app/src/main.rs): `app/src/main.rs`
- [Conversational REPL](https://github.com/joasasantos/neuropurple/blob/main/app/src/repl.rs): `app/src/repl.rs`

### Investigation

- [N1 Investigation](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/orchestrate.rs): `crates/harness/src/orchestrate.rs`
- [Telemetry Sources](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/sources.rs): `crates/harness/src/sources.rs`
- [SIEM Connectors](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/connectors.rs): `crates/harness/src/connectors.rs`
- [IOC Extraction](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/ioc.rs): `crates/harness/src/ioc.rs`
- [Threat Intel](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/intel.rs): `crates/harness/src/intel.rs`
- [Log Analysis](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/analyze.rs): `crates/harness/src/analyze.rs`
- [Threat Hunting](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/hunt.rs): `crates/harness/src/hunt.rs`
- [N1 Triage](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/triage.rs): `crates/harness/src/triage.rs`
- [Incident Reports](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/incident.rs): `crates/harness/src/incident.rs`
- [Report Export](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/report.rs): `crates/harness/src/report.rs`

### Purple Team

- [Purple Loop](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/purple.rs): `crates/harness/src/purple.rs`
- [BAS Emulation](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/emulate.rs): `crates/harness/src/emulate.rs`
- [Detection Rules](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/detection.rs): `crates/harness/src/detection.rs`
- [Coverage Graph](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/coverage.rs): `crates/harness/src/coverage.rs`
- [Reward Learning](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/rl.rs): `crates/harness/src/rl.rs`

### Response Operations

- [Approved SOAR](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/soar.rs): `crates/harness/src/soar.rs`
- [Action Guardrails](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/guardrails.rs): `crates/harness/src/guardrails.rs`
- [Response Sinks](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/sink.rs): `crates/harness/src/sink.rs`

### Shared Services

- [Operator Library](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/agents.rs): `crates/harness/src/agents.rs`
- [Model Pool](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/pool.rs): `crates/harness/src/pool.rs`
- [Results Dashboard](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/dashboard.rs): `crates/harness/src/dashboard.rs`
- [Cron Scheduler](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/cron.rs): `crates/harness/src/cron.rs`
- [On-Target Agents](https://github.com/joasasantos/neuropurple/blob/main/crates/harness/src/agentgen.rs): `crates/harness/src/agentgen.rs`

### Other components

- **Analyst**

## Connections

- Analyst → CLI Entry: starts (evidence: `README.md`)
- CLI Entry → Conversational REPL: opens (evidence: `app/src/main.rs`)
- Conversational REPL → N1 Investigation: requests investigation (evidence: `README.md`)
- N1 Investigation → Telemetry Sources: ingests (evidence: `crates/harness/src/orchestrate.rs`)
- Telemetry Sources → SIEM Connectors: queries live sources (evidence: `crates/harness/src/sources.rs`)
- N1 Investigation → Threat Intel: enriches indicators (evidence: `crates/harness/src/orchestrate.rs`)
- N1 Investigation → Log Analysis: runs analysis (evidence: `crates/harness/src/orchestrate.rs`)
- N1 Investigation → Threat Hunting: runs hunt (evidence: `crates/harness/src/orchestrate.rs`)
- N1 Investigation → Incident Reports: records findings (evidence: `README.md`)
- N1 Investigation → Report Export: produces report (evidence: `README.md`)
- Log Analysis → IOC Extraction: extracts indicators (evidence: `crates/harness/src/analyze.rs`)
- Threat Hunting → IOC Extraction: pivots on indicators (evidence: `crates/harness/src/hunt.rs`)
- Threat Hunting → Telemetry Sources: searches pivots (evidence: `crates/harness/src/hunt.rs`)
- Conversational REPL → N1 Triage: routes triage (evidence: `README.md`)
- Conversational REPL → Purple Loop: starts purple loop (evidence: `README.md`)
- Purple Loop → BAS Emulation: runs technique (evidence: `crates/harness/src/purple.rs`)
- Purple Loop → SIEM Connectors: probes detections (evidence: `README.md`)
- Purple Loop → Detection Rules: authors rules (evidence: `crates/harness/src/purple.rs`)
- Purple Loop → Coverage Graph: updates coverage (evidence: `README.md`)
- Purple Loop → Reward Learning: updates reward (evidence: `crates/harness/src/purple.rs`)
- Conversational REPL → Approved SOAR: requests response (evidence: `README.md`)
- Approved SOAR → Action Guardrails: checks actions (evidence: `crates/harness/src/soar.rs`)
- Approved SOAR → Response Sinks: dispatches approved actions (evidence: `crates/harness/src/soar.rs`)
- N1 Investigation → Operator Library: uses operators (evidence: `crates/harness/src/orchestrate.rs`)
- N1 Investigation → Model Pool: requests model output (evidence: `crates/harness/src/orchestrate.rs`)
- Conversational REPL → Results Dashboard: opens dashboard (evidence: `README.md`)
- Conversational REPL → Cron Scheduler: schedules commands (evidence: `README.md`)
- Conversational REPL → On-Target Agents: generates agents (evidence: `README.md`)