# mohamed2007sarhan/aegiscore architecture

> Architecture diagram of the GitHub repository mohamed2007sarhan/aegiscore, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mohamed2007sarhan/aegiscore
- Repository: https://github.com/mohamed2007sarhan/aegiscore

## Overview

AegisCore is presented as a security monitoring and response platform: telemetry enters a central event flow, passes through threat analysis and decisions, then reaches analyst collaboration and response. The README documents broader clustering, sandbox, hardening, and API capabilities. The tree supports file analysis, event-storage interfaces, and several collector integrations, but the sampled source does not establish their wiring to the documented core; those links are therefore not inferred.

Main entry points: [`cmd/main.go`](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go) (Central Event Bus), [`internal/file-analysis/pipeline.go`](https://github.com/mohamed2007sarhan/aegiscore/blob/main/internal/file-analysis/pipeline.go) (Risk Engine), [`integrations/crowdsec`](https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/crowdsec) (CrowdSec Collector), [`integrations/zeek`](https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/zeek) (Zeek Collector)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingest["Telemetry Ingestion"]
  node_crowdsec["CrowdSec Collector"]
  node_suricata["Suricata Collector"]
  node_zeek["Zeek Collector"]
  node_wazuh["Wazuh Collector"]
  node_eventbus["Central Event Bus<br/>[main.go]"]
end

subgraph group_analysis["Threat Analysis"]
  node_correlation["Correlation Engine<br/>[main.go]"]
  node_risk["Risk Engine<br/>[pipeline.go]"]
  node_fileanalysis["File Analysis<br/>[pipeline.go]"]
  node_decision["Decision Engine<br/>[main.go]"]
end

subgraph group_response["Operations and Response"]
  node_orchestrator["AI Orchestrator<br/>[main.go]"]
  node_socagents["AI SOC Team<br/>[main.go]"]
  node_guard["AI Guard Layer<br/>[main.go]"]
  node_execution["Secure Execution<br/>[main.go]"]
  node_patching["Virtual Patching"]
  node_sandbox["Sandbox Isolation"]
end

subgraph group_runtime["Runtime and State"]
  node_storage[("Event Storage<br/>[storage.go]")]
  node_ha["HA Clustering<br/>[main.go]"]
  node_api["REST API<br/>[main.go]"]
end

node_operator(("Platform Operator"))

node_crowdsec -->|"sends logs"| node_eventbus
node_suricata -->|"sends telemetry"| node_eventbus
node_zeek -->|"sends telemetry"| node_eventbus
node_wazuh -->|"sends telemetry"| node_eventbus
node_eventbus -->|"dispatches events"| node_correlation
node_correlation -->|"evaluates threats"| node_risk
node_risk -->|"provides risk"| node_decision
node_decision -->|"requests analysis"| node_orchestrator
node_orchestrator -->|"coordinates agents"| node_socagents
node_socagents -->|"submits findings"| node_guard
node_guard -->|"authorizes response"| node_execution
node_execution -->|"applies patches"| node_patching
node_execution -->|"isolates runtime"| node_sandbox
node_operator -->|"queries status"| node_api
node_operator -->|"analyzes file"| node_fileanalysis
node_fileanalysis -->|"returns report"| node_operator
node_ha -->|"deduplicates events"| node_eventbus
node_eventbus -->|"persists events"| node_storage

click node_crowdsec "https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/crowdsec"
click node_zeek "https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/zeek"
click node_wazuh "https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/wazuh"
click node_eventbus "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"
click node_correlation "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"
click node_risk "https://github.com/mohamed2007sarhan/aegiscore/blob/main/internal/file-analysis/pipeline.go"
click node_fileanalysis "https://github.com/mohamed2007sarhan/aegiscore/blob/main/internal/file-analysis/pipeline.go"
click node_decision "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"
click node_orchestrator "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"
click node_socagents "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"
click node_guard "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"
click node_execution "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"
click node_patching "https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/crowdsec/pkg/appsec"
click node_sandbox "https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/crowdsec/pkg/appsec"
click node_storage "https://github.com/mohamed2007sarhan/aegiscore/blob/main/internal/storage/storage.go"
click node_ha "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"
click node_api "https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_crowdsec,node_suricata,node_zeek,node_wazuh,node_eventbus toneBlue
class node_correlation,node_risk,node_fileanalysis,node_decision toneAmber
class node_orchestrator,node_socagents,node_guard,node_execution,node_patching,node_sandbox toneMint
class node_storage,node_ha,node_api toneRose
class node_operator toneIndigo
```

## Components

### Telemetry Ingestion

- [CrowdSec Collector](https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/crowdsec): `integrations/crowdsec`
- **Suricata Collector**
- [Zeek Collector](https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/zeek): `integrations/zeek`
- [Wazuh Collector](https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/wazuh): `integrations/wazuh`
- [Central Event Bus](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`

### Threat Analysis

- [Correlation Engine](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`
- [Risk Engine](https://github.com/mohamed2007sarhan/aegiscore/blob/main/internal/file-analysis/pipeline.go): `internal/file-analysis/pipeline.go`
- [File Analysis](https://github.com/mohamed2007sarhan/aegiscore/blob/main/internal/file-analysis/pipeline.go): `internal/file-analysis/pipeline.go`
- [Decision Engine](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`

### Operations and Response

- [AI Orchestrator](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`
- [AI SOC Team](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`
- [AI Guard Layer](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`
- [Secure Execution](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`
- [Virtual Patching](https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/crowdsec/pkg/appsec): `integrations/crowdsec/pkg/appsec`
- [Sandbox Isolation](https://github.com/mohamed2007sarhan/aegiscore/tree/main/integrations/crowdsec/pkg/appsec): `integrations/crowdsec/pkg/appsec`

### Runtime and State

- [Event Storage](https://github.com/mohamed2007sarhan/aegiscore/blob/main/internal/storage/storage.go): `internal/storage/storage.go`
- [HA Clustering](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`
- [REST API](https://github.com/mohamed2007sarhan/aegiscore/blob/main/cmd/main.go): `cmd/main.go`

### Other components

- **Platform Operator**

## Connections

- CrowdSec Collector → Central Event Bus: sends logs
- Suricata Collector → Central Event Bus: sends telemetry
- Zeek Collector → Central Event Bus: sends telemetry
- Wazuh Collector → Central Event Bus: sends telemetry
- Central Event Bus → Correlation Engine: dispatches events
- Correlation Engine → Risk Engine: evaluates threats
- Risk Engine → Decision Engine: provides risk
- Decision Engine → AI Orchestrator: requests analysis
- AI Orchestrator → AI SOC Team: coordinates agents
- AI SOC Team → AI Guard Layer: submits findings
- AI Guard Layer → Secure Execution: authorizes response
- Secure Execution → Virtual Patching: applies patches
- Secure Execution → Sandbox Isolation: isolates runtime
- Platform Operator → REST API: queries status
- Platform Operator → File Analysis: analyzes file
- File Analysis → Platform Operator: returns report
- HA Clustering → Central Event Bus: deduplicates events
- Central Event Bus → Event Storage: persists events