How mitre/heimdall2 works
Heimdall is a security-assessment results viewer and reporting system, offered as a standalone Lite frontend or as a server-backed application. The principal workflow is to load assessment data, convert supported formats to Heimdall’s representation, review and compare results, and produce reports; the server adds persistent evaluations, users, groups, and an authenticated REST API. The map includes documented capabilities and sampled backend relationships. Several frontend-to-backend and converter-to-frontend links are documented at product level but their runtime wiring was not sampled.
Main entry points: evaluations.controller.ts Evaluation API · groups.service.ts Groups and sharing · App.vue Heimdall UI · Results.vue Review views
Components 21
Review and reporting
- Heimdall UI
apps/frontend/src/App.vue - Review views
apps/frontend/src/views/Results.vue - Comparison view
apps/frontend/src/views/Compare.vue - Report exports
apps/frontend/src/components/global/ExportHTMLModal.vue - Frontend state and API
apps/frontend/src/store/server.ts
Ingestion and formats
- Upload interfaces
apps/frontend/src/components/global/upload_tabs/FileReader.vue - OHDF converters
libs/hdf-converters/src/base-converter.ts - InSpec parsing
libs/inspecjs/src/context.ts
Backend API
- Evaluation API
apps/backend/src/evaluations/evaluations.controller.ts - Evaluation service
apps/backend/src/evaluations/evaluations.service.ts - Tags and statistics
apps/backend/src/statistics/statistics.controller.ts
Identity and access
- Authentication
apps/backend/src/authn/authn.service.ts - Authorization
apps/backend/src/casl/casl-ability.factory.ts - User management
apps/backend/src/users/users.service.ts - Groups and sharing
apps/backend/src/groups/groups.service.ts
Persistent data
- Evaluation records
apps/backend/src/evaluations/evaluation.model.ts - User records
apps/backend/src/users/user.model.ts - Group records
apps/backend/src/groups/group.model.ts
Other components
- Assessor
- PostgreSQL
- External data sources
Connections 23
- Assessor → Heimdall UI: reviews
README.md - Heimdall UI → Upload interfaces: loads reports
README.md - Upload interfaces → OHDF converters: converts formats
- InSpec parsing → OHDF converters: parses InSpec
- OHDF converters → Review views: supplies results
- Review views → Comparison view: compares assessments
README.md - Review views → Report exports: produces reports
README.md - Heimdall UI → Frontend state and API: uses server state
apps/frontend/src/App.vue - Frontend state and API → Evaluation API: requests API
- Evaluation API → Evaluation service: delegates to
apps/backend/src/evaluations/evaluations.controller.ts - Evaluation API → Authorization: checks permissions
apps/backend/src/evaluations/evaluations.controller.ts - Evaluation API → Evaluation records: reads evaluations
apps/backend/src/evaluations/evaluations.controller.ts - Evaluation API → Tags and statistics: supports analysis
- Authentication → User management: validates users
apps/backend/src/authn/authn.service.ts - Authentication → User records: issues sessions
apps/backend/src/authn/authn.service.ts - User management → User records: manages users
apps/backend/src/users/users.service.ts - Groups and sharing → Group records: manages groups
apps/backend/src/groups/groups.service.ts - Groups and sharing → User management: maintains owners
apps/backend/src/users/users.service.ts - Groups and sharing → Evaluation service: links evaluations
apps/backend/src/groups/groups.controller.ts - Evaluation records → PostgreSQL: persists in
- User records → PostgreSQL: persists in
- Group records → PostgreSQL: persists in
- External data sources → Upload interfaces: provides reports
README.md