How meghashyamravuru/rt-hid works
RT-HID is a standalone, cross-platform host intrusion detection product. Its primary workflow is to collect local host signals, normalize them as events, apply explainable rules, persist evidence and incidents in SQLite, and present them through a loopback-only authenticated dashboard or console commands. The graph preserves the documented Linux/Windows collectors, process telemetry, detection, incident investigation, and API/dashboard capabilities. Agent and API internals were not sampled; those links rely on README statements or the excerpted CLI wiring.
Main entry points: agent.py Monitor agent · api.py Authenticated API · linux.py Linux collectors · models.py Host event model
Components 17
Host runtime
- Monitor agent
src/rt_hid/host/agent.py - Host configuration
src/rt_hid/host/config.py - Platform selection
src/rt_hid/host/platform.py - Host event model
src/rt_hid/host/models.py - SQLite evidence store
src/rt_hid/host/storage.py
Signal collection
- Collector lifecycle
src/rt_hid/host/collectors/base.py - Linux collectors
src/rt_hid/host/collectors/linux.py - Windows collectors
src/rt_hid/host/collectors/windows.py - Process telemetry
src/rt_hid/host/collectors/linux.py
Detection and response
- Detection rules
src/rt_hid/host/detection/engine.py - Alert management
src/rt_hid/host/alerts/manager.py
Local access
- Command interface
src/rt_hid/host/cli.py - Authenticated API
src/rt_hid/host/api.py - Dashboard views
src/rt_hid/host/dashboard.html - Login and password change
src/rt_hid/host/login.html - Password change view
src/rt_hid/host/change_password.html
Other components
- Host operator
Connections 25
- Host operator → Command interface: runs commands
README.md - Command interface → Monitor agent: starts monitor
src/rt_hid/host/cli.py - Command interface → Authenticated API: creates app
src/rt_hid/host/cli.py - Monitor agent → Host configuration: uses settings
README.md - Monitor agent → Platform selection: selects platform
README.md - Monitor agent → Linux collectors: runs collection
README.md - Monitor agent → Windows collectors: runs collection
README.md - Linux collectors → Host event model: emits events
README.md - Windows collectors → Host event model: emits events
src/rt_hid/host/collectors/windows.py - Collector lifecycle → Host event model: sends events
src/rt_hid/host/collectors/base.py - Linux collectors → Collector lifecycle: extends lifecycle
- Windows collectors → Collector lifecycle: extends lifecycle
src/rt_hid/host/collectors/windows.py - Linux collectors → Process telemetry: collects processes
README.md - Monitor agent → Detection rules: evaluates events
README.md - Host event model → Detection rules: provides evidence
src/rt_hid/host/detection/engine.py - Detection rules → Alert management: creates detections
README.md - Alert management → SQLite evidence store: saves incidents
src/rt_hid/host/alerts/manager.py - Monitor agent → SQLite evidence store: stores evidence
README.md - Authenticated API → SQLite evidence store: serves records
README.md - Authenticated API → Alert management: handles incident actions
README.md - Host operator → Login and password change: authenticates
README.md - Login and password change → Authenticated API: opens session
README.md - Authenticated API → Password change view: requires password change
README.md - Dashboard views → Authenticated API: requests views
README.md - Host operator → Dashboard views: investigates alerts
README.md