How mints-ai/shield-desk works
ShieldDesk is a multi-tenant security operations platform: analysts ingest alerts, investigate incidents and vulnerability exposure, plan mitigations, obtain tiered human approval, and coordinate endpoint response. Its Next.js gateway connects dashboards and APIs to persistence, local AI, and dedicated ingest, scan, threat, advisor, identity, webhook, and agent services. The README documents major capabilities not fully represented in sampled source; those branches are shown at supported directory paths, while uncertain internal wiring is omitted.
Main entry points: index.ts Tenant data store · api Next.js APIs · dashboard SOC dashboards · route.ts AI chat API
Components 28
SOC Operations
- SOC dashboards
src/app/dashboard - AI chat drawer
src/components/ai-chat/ChatWidget.tsx - Incident records
src/app/api/ingest/webhooks/route.ts - Compliance evidence
src/lib/compliance/iso27001.ts - Executive scorecard
src/lib/reporting/scorecard.ts
API Gateway
- Next.js APIs
src/app/api - Identity and sessions
services/iam/src - Webhook ingestion
src/app/api/ingest/webhooks/route.ts - AI advisor API
src/app/api/ai/advisor/route.ts - AI chat API
src/app/api/chat/route.ts - SOC chat tools
src/lib/tools/index.ts
Security Intelligence
- Telemetry ingestion
services/ingest - Threat detection
services/threat - Vulnerability scanner
services/scan - CVE ML engine
ai-chat-desk/cve_ai_engine.py - ML service
ai-chat-desk/server.py - Advisor RAG
services/ai-advisor
Governance Response
- Endpoint agents
agent/pkg/handlers/actions.go - Tier 3 daemon
agent/rust_daemon/src/main.rs - Approval governance
src/lib/governance/approvalTokens.ts - Fleet commands
src/lib/fleet/fleet.ts - Alert dispatcher
src/lib/notifications/dispatcher.ts - Webhook dispatcher
services/webhooks
Platform Services
- Tenant data store
src/lib/db/index.ts - Local Ollama
src/lib/ai/ollama.ts
Other components
- Analyst
- SIEM / EDR
- Slack / Teams
Connections 31
- Analyst → SOC dashboards: uses
- Analyst → AI chat drawer: asks
- SOC dashboards → Next.js APIs: requests
- AI chat drawer → AI chat API: streams chat
- Next.js APIs → Identity and sessions: authenticates
- Next.js APIs → Tenant data store: reads and writes
- Webhook ingestion → SIEM / EDR: receives alerts
- Webhook ingestion → Tenant data store: writes incidents
- Webhook ingestion → Alert dispatcher: dispatches alert
- Telemetry ingestion → Tenant data store: persists telemetry
- Endpoint agents → Tenant data store: sends telemetry
- Tier 3 daemon → Tenant data store: sends telemetry
- Threat detection → Tenant data store: uses threat data
- Vulnerability scanner → ML service: requests analysis
- ML service → CVE ML engine: predicts CVE risk
- Next.js APIs → Vulnerability scanner: requests scans
- AI advisor API → Advisor RAG: requests runbook
- AI chat API → Local Ollama: routes and streams
- AI chat API → SOC chat tools: dispatches tools
- AI chat API → Approval governance: checks permissions
- SOC chat tools → Tenant data store: queries SOC data
- Approval governance → Tenant data store: stores approvals
- Next.js APIs → Fleet commands: dispatches commands
- Fleet commands → Endpoint agents: commands fleet
- Fleet commands → Tier 3 daemon: high-risk actions
- Alert dispatcher → Webhook dispatcher: dispatches events
- Webhook dispatcher → Slack / Teams: delivers alerts
- Compliance evidence → Tenant data store: assembles evidence
- Executive scorecard → Tenant data store: reads posture data
- SOC dashboards → Compliance evidence: views evidence
- SOC dashboards → Executive scorecard: views posture