# manashbajpai8840-alt/ai-soc-simulator architecture

> Architecture diagram of the GitHub repository manashbajpai8840-alt/ai-soc-simulator, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/manashbajpai8840-alt/ai-soc-simulator
- Repository: https://github.com/manashbajpai8840-alt/ai-soc-simulator

## Overview

AI SOC Simulator generates synthetic security events, filters them with heuristic rules, sends flagged events for AI or mock triage, and applies a confidence-gated response. Confirmed incidents can produce forensic reports; events, verdicts, and blocks are stored in SQLite for the live dashboard. The main workflow and dashboard reads are supported by sampled source. The README documents the broader capabilities; live system actions and Claude calls are optional integrations.

Main entry points: [`ai_soc_simulator/main.py`](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/main.py) (Pipeline Orchestrator), [`ai_soc_simulator/responder.py`](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/responder.py) (Response Actions), [`ai_soc_simulator/db.py`](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/db.py) (SQLite Access Layer), [`ai_soc_simulator/config.py`](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/config.py) (Runtime Configuration)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_simulation["Event Simulation"]
  node_generator["Synthetic Log Generator<br/>[log_generator.py]"]
end

subgraph group_triage["Detection And Triage"]
  node_main["Pipeline Orchestrator<br/>[main.py]"]
  node_detector["Heuristic Prefilter<br/>[detector.py]"]
  node_analyzer["AI / Mock Triage<br/>[ai_analyzer.py]"]
  node_config["Runtime Configuration<br/>[config.py]"]
end

subgraph group_response["Response And Evidence"]
  node_responder["Response Actions<br/>[responder.py]"]
  node_forensics["Forensic Reports"]
end

subgraph group_visibility["Persistence And Dashboard"]
  node_dbmodule["SQLite Access Layer<br/>[db.py]"]
  node_sqlite[("SQLite Database")]
  node_dashboard["Live Dashboard<br/>[dashboard.py]"]
end

node_operator(("Operator"))
node_claude{{"Claude API"}}
node_firewall{{"Host Firewall"}}
node_process{{"Host Processes"}}

node_operator -->|"starts simulator"| node_main
node_operator -->|"opens dashboard"| node_dashboard
node_main -->|"requests event"| node_generator
node_generator -->|"returns event"| node_main
node_main -->|"checks event"| node_detector
node_main -->|"records event"| node_dbmodule
node_main -->|"checks block status"| node_dbmodule
node_main -->|"triages flagged event"| node_analyzer
node_analyzer -.->|"requests analysis"| node_claude
node_main -->|"saves verdict"| node_dbmodule
node_main -->|"dispatches response"| node_responder
node_main -->|"creates incident report"| node_responder
node_responder -.->|"applies IP rule"| node_firewall
node_responder -.->|"sends SIGSTOP"| node_process
node_responder -->|"writes report"| node_forensics
node_main -->|"saves response and block"| node_dbmodule
node_dashboard -->|"reads stats and events"| node_dbmodule
node_dbmodule -->|"reads and writes"| node_sqlite
node_main -->|"reads settings"| node_config
node_analyzer -->|"reads model settings"| node_config
node_detector -->|"reads thresholds"| node_config
node_responder -->|"reads report settings"| node_config
node_dashboard -->|"reads display settings"| node_config

click node_main "https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/main.py"
click node_generator "https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/log_generator.py"
click node_detector "https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/detector.py"
click node_analyzer "https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/ai_analyzer.py"
click node_responder "https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/responder.py"
click node_dbmodule "https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/db.py"
click node_dashboard "https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/dashboard.py"
click node_config "https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/config.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_generator toneBlue
class node_main,node_detector,node_analyzer,node_config toneAmber
class node_responder,node_forensics,node_claude toneMint
class node_dbmodule,node_sqlite,node_dashboard toneRose
class node_operator,node_firewall,node_process toneIndigo
```

## Components

### Event Simulation

- [Synthetic Log Generator](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/log_generator.py): `ai_soc_simulator/log_generator.py`

### Detection And Triage

- [Pipeline Orchestrator](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/main.py): `ai_soc_simulator/main.py`
- [Heuristic Prefilter](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/detector.py): `ai_soc_simulator/detector.py`
- [AI / Mock Triage](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/ai_analyzer.py): `ai_soc_simulator/ai_analyzer.py`
- [Runtime Configuration](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/config.py): `ai_soc_simulator/config.py`

### Response And Evidence

- [Response Actions](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/responder.py): `ai_soc_simulator/responder.py`
- **Forensic Reports**

### Persistence And Dashboard

- [SQLite Access Layer](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/db.py): `ai_soc_simulator/db.py`
- **SQLite Database**
- [Live Dashboard](https://github.com/manashbajpai8840-alt/ai-soc-simulator/blob/main/ai_soc_simulator/dashboard.py): `ai_soc_simulator/dashboard.py`

### Other components

- **Operator**
- **Claude API**
- **Host Firewall**
- **Host Processes**

## Connections

- Operator → Pipeline Orchestrator: starts simulator
- Operator → Live Dashboard: opens dashboard
- Pipeline Orchestrator → Synthetic Log Generator: requests event
- Synthetic Log Generator → Pipeline Orchestrator: returns event
- Pipeline Orchestrator → Heuristic Prefilter: checks event
- Pipeline Orchestrator → SQLite Access Layer: records event
- Pipeline Orchestrator → SQLite Access Layer: checks block status
- Pipeline Orchestrator → AI / Mock Triage: triages flagged event
- AI / Mock Triage → Claude API: requests analysis
- Pipeline Orchestrator → SQLite Access Layer: saves verdict
- Pipeline Orchestrator → Response Actions: dispatches response
- Pipeline Orchestrator → Response Actions: creates incident report
- Response Actions → Host Firewall: applies IP rule
- Response Actions → Host Processes: sends SIGSTOP
- Response Actions → Forensic Reports: writes report
- Pipeline Orchestrator → SQLite Access Layer: saves response and block
- Live Dashboard → SQLite Access Layer: reads stats and events
- SQLite Access Layer → SQLite Database: reads and writes
- Pipeline Orchestrator → Runtime Configuration: reads settings
- AI / Mock Triage → Runtime Configuration: reads model settings
- Heuristic Prefilter → Runtime Configuration: reads thresholds
- Response Actions → Runtime Configuration: reads report settings
- Live Dashboard → Runtime Configuration: reads display settings