How mohamed2007sarhan/aegiscore works
AegisCore is presented as a security monitoring and response platform: telemetry enters a central event flow, passes through threat analysis and decisions, then reaches analyst collaboration and response. The README documents broader clustering, sandbox, hardening, and API capabilities. The tree supports file analysis, event-storage interfaces, and several collector integrations, but the sampled source does not establish their wiring to the documented core; those links are therefore not inferred.
Main entry points: main.go Central Event Bus · pipeline.go Risk Engine · crowdsec CrowdSec Collector · zeek Zeek Collector
Components 19
Telemetry Ingestion
- CrowdSec Collector
integrations/crowdsec - Suricata Collector
- Zeek Collector
integrations/zeek - Wazuh Collector
integrations/wazuh - Central Event Bus
cmd/main.go
Threat Analysis
- Correlation Engine
cmd/main.go - Risk Engine
internal/file-analysis/pipeline.go - File Analysis
internal/file-analysis/pipeline.go - Decision Engine
cmd/main.go
Operations and Response
- AI Orchestrator
cmd/main.go - AI SOC Team
cmd/main.go - AI Guard Layer
cmd/main.go - Secure Execution
cmd/main.go - Virtual Patching
integrations/crowdsec/pkg/appsec - Sandbox Isolation
integrations/crowdsec/pkg/appsec
Runtime and State
- Event Storage
internal/storage/storage.go - HA Clustering
cmd/main.go - REST API
cmd/main.go
Other components
- Platform Operator
Connections 18
- CrowdSec Collector → Central Event Bus: sends logs
- Suricata Collector → Central Event Bus: sends telemetry
- Zeek Collector → Central Event Bus: sends telemetry
- Wazuh Collector → Central Event Bus: sends telemetry
- Central Event Bus → Correlation Engine: dispatches events
- Correlation Engine → Risk Engine: evaluates threats
- Risk Engine → Decision Engine: provides risk
- Decision Engine → AI Orchestrator: requests analysis
- AI Orchestrator → AI SOC Team: coordinates agents
- AI SOC Team → AI Guard Layer: submits findings
- AI Guard Layer → Secure Execution: authorizes response
- Secure Execution → Virtual Patching: applies patches
- Secure Execution → Sandbox Isolation: isolates runtime
- Platform Operator → REST API: queries status
- Platform Operator → File Analysis: analyzes file
- File Analysis → Platform Operator: returns report
- HA Clustering → Central Event Bus: deduplicates events
- Central Event Bus → Event Storage: persists events