# meghashyamravuru/rt-hid architecture

> Architecture diagram of the GitHub repository meghashyamravuru/rt-hid, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/meghashyamravuru/rt-hid
- Repository: https://github.com/meghashyamravuru/rt-hid

## Overview

RT-HID is a standalone, cross-platform host intrusion detection product. Its primary workflow is to collect local host signals, normalize them as events, apply explainable rules, persist evidence and incidents in SQLite, and present them through a loopback-only authenticated dashboard or console commands. The graph preserves the documented Linux/Windows collectors, process telemetry, detection, incident investigation, and API/dashboard capabilities. Agent and API internals were not sampled; those links rely on README statements or the excerpted CLI wiring.

Main entry points: [`src/rt_hid/host/agent.py`](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/agent.py) (Monitor agent), [`src/rt_hid/host/api.py`](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/api.py) (Authenticated API), [`src/rt_hid/host/collectors/linux.py`](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/linux.py) (Linux collectors), [`src/rt_hid/host/models.py`](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/models.py) (Host event model)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Host runtime"]
  node_agent["Monitor agent<br/>[agent.py]"]
  node_config["Host configuration<br/>[config.py]"]
  node_capabilities["Platform selection<br/>[platform.py]"]
  node_event_model["Host event model<br/>[models.py]"]
  node_database[("SQLite evidence store<br/>[storage.py]")]
end

subgraph group_collection["Signal collection"]
  node_collector_base["Collector lifecycle<br/>[base.py]"]
  node_linux_collectors["Linux collectors<br/>[linux.py]"]
  node_windows_collectors["Windows collectors<br/>[windows.py]"]
  node_process_telemetry["Process telemetry<br/>[linux.py]"]
end

subgraph group_analysis["Detection and response"]
  node_detection["Detection rules<br/>[engine.py]"]
  node_alert_manager["Alert management<br/>[manager.py]"]
end

subgraph group_access["Local access"]
  node_cli["Command interface<br/>[cli.py]"]
  node_api["Authenticated API<br/>[api.py]"]
  node_dashboard["Dashboard views<br/>[dashboard.html]"]
  node_login["Login and password change<br/>[login.html]"]
  node_password_view["Password change view"]
end

node_operator(("Host operator"))

node_operator -->|"runs commands"| node_cli
node_cli -->|"starts monitor"| node_agent
node_cli -->|"creates app"| node_api
node_agent -->|"uses settings"| node_config
node_agent -->|"selects platform"| node_capabilities
node_agent -->|"runs collection"| node_linux_collectors
node_agent -->|"runs collection"| node_windows_collectors
node_linux_collectors -->|"emits events"| node_event_model
node_windows_collectors -->|"emits events"| node_event_model
node_collector_base -->|"sends events"| node_event_model
node_linux_collectors -.->|"extends lifecycle"| node_collector_base
node_windows_collectors -->|"extends lifecycle"| node_collector_base
node_linux_collectors -->|"collects processes"| node_process_telemetry
node_agent -->|"evaluates events"| node_detection
node_event_model -->|"provides evidence"| node_detection
node_detection -->|"creates detections"| node_alert_manager
node_alert_manager -->|"saves incidents"| node_database
node_agent -->|"stores evidence"| node_database
node_api -->|"serves records"| node_database
node_api -->|"handles incident actions"| node_alert_manager
node_operator -->|"authenticates"| node_login
node_login -->|"opens session"| node_api
node_api -->|"requires password change"| node_password_view
node_dashboard -->|"requests views"| node_api
node_operator -->|"investigates alerts"| node_dashboard

click node_cli "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/cli.py"
click node_agent "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/agent.py"
click node_config "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/config.py"
click node_capabilities "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/platform.py"
click node_collector_base "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/base.py"
click node_linux_collectors "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/linux.py"
click node_windows_collectors "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/windows.py"
click node_event_model "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/models.py"
click node_process_telemetry "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/linux.py"
click node_detection "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/detection/engine.py"
click node_alert_manager "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/alerts/manager.py"
click node_database "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/storage.py"
click node_api "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/api.py"
click node_dashboard "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/dashboard.html"
click node_login "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/login.html"
click node_password_view "https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/change_password.html"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_agent,node_config,node_capabilities,node_event_model,node_database toneBlue
class node_collector_base,node_linux_collectors,node_windows_collectors,node_process_telemetry toneAmber
class node_detection,node_alert_manager toneMint
class node_cli,node_api,node_dashboard,node_login,node_password_view toneRose
class node_operator toneIndigo
```

## Components

### Host runtime

- [Monitor agent](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/agent.py): `src/rt_hid/host/agent.py`
- [Host configuration](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/config.py): `src/rt_hid/host/config.py`
- [Platform selection](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/platform.py): `src/rt_hid/host/platform.py`
- [Host event model](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/models.py): `src/rt_hid/host/models.py`
- [SQLite evidence store](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/storage.py): `src/rt_hid/host/storage.py`

### Signal collection

- [Collector lifecycle](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/base.py): `src/rt_hid/host/collectors/base.py`
- [Linux collectors](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/linux.py): `src/rt_hid/host/collectors/linux.py`
- [Windows collectors](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/windows.py): `src/rt_hid/host/collectors/windows.py`
- [Process telemetry](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/collectors/linux.py): `src/rt_hid/host/collectors/linux.py`

### Detection and response

- [Detection rules](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/detection/engine.py): `src/rt_hid/host/detection/engine.py`
- [Alert management](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/alerts/manager.py): `src/rt_hid/host/alerts/manager.py`

### Local access

- [Command interface](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/cli.py): `src/rt_hid/host/cli.py`
- [Authenticated API](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/api.py): `src/rt_hid/host/api.py`
- [Dashboard views](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/dashboard.html): `src/rt_hid/host/dashboard.html`
- [Login and password change](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/login.html): `src/rt_hid/host/login.html`
- [Password change view](https://github.com/meghashyamravuru/rt-hid/blob/master/src/rt_hid/host/change_password.html): `src/rt_hid/host/change_password.html`

### Other components

- **Host operator**

## Connections

- Host operator → Command interface: runs commands (evidence: `README.md`)
- Command interface → Monitor agent: starts monitor (evidence: `src/rt_hid/host/cli.py`)
- Command interface → Authenticated API: creates app (evidence: `src/rt_hid/host/cli.py`)
- Monitor agent → Host configuration: uses settings (evidence: `README.md`)
- Monitor agent → Platform selection: selects platform (evidence: `README.md`)
- Monitor agent → Linux collectors: runs collection (evidence: `README.md`)
- Monitor agent → Windows collectors: runs collection (evidence: `README.md`)
- Linux collectors → Host event model: emits events (evidence: `README.md`)
- Windows collectors → Host event model: emits events (evidence: `src/rt_hid/host/collectors/windows.py`)
- Collector lifecycle → Host event model: sends events (evidence: `src/rt_hid/host/collectors/base.py`)
- Linux collectors → Collector lifecycle: extends lifecycle
- Windows collectors → Collector lifecycle: extends lifecycle (evidence: `src/rt_hid/host/collectors/windows.py`)
- Linux collectors → Process telemetry: collects processes (evidence: `README.md`)
- Monitor agent → Detection rules: evaluates events (evidence: `README.md`)
- Host event model → Detection rules: provides evidence (evidence: `src/rt_hid/host/detection/engine.py`)
- Detection rules → Alert management: creates detections (evidence: `README.md`)
- Alert management → SQLite evidence store: saves incidents (evidence: `src/rt_hid/host/alerts/manager.py`)
- Monitor agent → SQLite evidence store: stores evidence (evidence: `README.md`)
- Authenticated API → SQLite evidence store: serves records (evidence: `README.md`)
- Authenticated API → Alert management: handles incident actions (evidence: `README.md`)
- Host operator → Login and password change: authenticates (evidence: `README.md`)
- Login and password change → Authenticated API: opens session (evidence: `README.md`)
- Authenticated API → Password change view: requires password change (evidence: `README.md`)
- Dashboard views → Authenticated API: requests views (evidence: `README.md`)
- Host operator → Dashboard views: investigates alerts (evidence: `README.md`)