# mohamed2007sarhan/kaevex architecture

> Architecture diagram of the GitHub repository mohamed2007sarhan/kaevex, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mohamed2007sarhan/kaevex
- Repository: https://github.com/mohamed2007sarhan/kaevex

## Overview

Kaevex is a Windows endpoint-defense and SOC platform with native, web, and Android operator surfaces. The main workflow is operators querying and acting through a client, the API or native controls dispatching security work to endpoint engines, and findings or actions returning to dashboards and optional cloud services. The README documents capabilities not fully visible in the sampled excerpts; those are represented as subsystems without inferring unshown internal call chains.

Main entry points: [`src/kaevex-engine.c`](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/kaevex-engine.c) (REST API engine), [`src/engines/net_engine.h`](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/net_engine.h) (Network defense), [`src/engines/soc_engine.h`](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/soc_engine.h) (SOC cluster mesh), [`src/gui/kaevex-gui.c`](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/gui/kaevex-gui.c) (Native controls)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_operator["Operator surfaces"]
  node_native["Native controls<br/>[kaevex-gui.c]"]
  node_web["Web SOC dashboard<br/>[App.tsx]"]
  node_android["Android security app<br/>[AppNavigation.kt]"]
  node_mobileviews["Mobile security views<br/>[DashboardScreen.kt]"]
  node_webviews["SOC dashboards<br/>[Dashboard.tsx]"]
end

subgraph group_api["Service and data access"]
  node_engine["REST API engine<br/>[kaevex-engine.c]"]
  node_mobileapi["Mobile and cluster API"]
  node_webclient["Dashboard API client<br/>[client.ts]"]
  node_androidclient["Android API service"]
  node_cloudsync["Cloud synchronization<br/>[supabase_engine.h]"]
end

subgraph group_defense["Endpoint defense"]
  node_network["Network defense<br/>[net_engine.h]"]
  node_firewall["Adaptive firewall<br/>[fw_engine.h]"]
  node_ransom["RansomShield recovery<br/>[ransom_engine.h]"]
  node_sandbox["SmartSandbox isolation<br/>[sbx_engine.h]"]
  node_vulnerability["CVE agent and updater<br/>[upd_engine.h]"]
  node_discovery["Application discovery<br/>[discovery_engine.h]"]
end

subgraph group_operations["SOC operations"]
  node_ai["AI SOC analysis"]
  node_cluster["SOC cluster mesh<br/>[soc_engine.h]"]
  node_boot["Bootkit forensics"]
end

subgraph group_integrations["External integrations"]
  node_windows["Windows endpoint APIs"]
  node_cloudai["Cloud AI inference"]
  node_supabase[("Supabase services")]
end

node_operator(("Security operator"))

node_operator -->|"operates"| node_native
node_operator -->|"operates"| node_web
node_operator -->|"operates"| node_android
node_web -->|"requests data"| node_webclient
node_web -->|"selects views"| node_webviews
node_webclient -->|"calls REST API"| node_engine
node_android -->|"requests data"| node_androidclient
node_android -->|"renders screens"| node_mobileviews
node_androidclient -->|"calls REST API"| node_mobileapi
node_native -->|"controls"| node_network
node_native -->|"controls"| node_firewall
node_engine -->|"serves security data"| node_network
node_engine -->|"dispatches lockdown"| node_firewall
node_engine -->|"dispatches remediation"| node_vulnerability
node_engine -->|"dispatches chat"| node_ai
node_engine -->|"dispatches cluster actions"| node_cluster
node_engine -->|"serves audit data"| node_boot
node_mobileapi -->|"manages pairing"| node_cluster
node_mobileapi -->|"reads threat data"| node_network
node_network -->|"inspects connections"| node_windows
node_firewall -->|"enforces rules"| node_windows
node_ransom -->|"monitors files"| node_windows
node_ransom -->|"uses recovery snapshots"| node_windows
node_sandbox -->|"isolates binaries"| node_windows
node_vulnerability -->|"inventories and patches"| node_windows
node_discovery -->|"discovers applications"| node_windows
node_ai -.->|"requests inference"| node_cloudai
node_cloudsync -.->|"syncs telemetry"| node_supabase
node_cluster -.->|"shares threat intelligence"| node_cluster

click node_native "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/gui/kaevex-gui.c"
click node_web "https://github.com/mohamed2007sarhan/kaevex/blob/main/dashboard/src/App.tsx"
click node_android "https://github.com/mohamed2007sarhan/kaevex/blob/main/Application/app/src/main/java/com/kaevex/fireware/ui/navigation/AppNavigation.kt"
click node_engine "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/kaevex-engine.c"
click node_mobileapi "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/mobile_api_engine.h"
click node_webclient "https://github.com/mohamed2007sarhan/kaevex/blob/main/dashboard/src/api/client.ts"
click node_androidclient "https://github.com/mohamed2007sarhan/kaevex/blob/main/Application/app/src/main/java/com/kaevex/fireware/data/api/KaevexApiService.kt"
click node_network "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/net_engine.h"
click node_firewall "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/fw_engine.h"
click node_ransom "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/ransom_engine.h"
click node_sandbox "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/sbx_engine.h"
click node_vulnerability "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/upd_engine.h"
click node_discovery "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/discovery_engine.h"
click node_ai "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/ai_together_engine.h"
click node_cluster "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/soc_engine.h"
click node_boot "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/boot_rootkit_engine.h"
click node_cloudsync "https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/supabase_engine.h"
click node_mobileviews "https://github.com/mohamed2007sarhan/kaevex/blob/main/Application/app/src/main/java/com/kaevex/fireware/ui/screens/dashboard/DashboardScreen.kt"
click node_webviews "https://github.com/mohamed2007sarhan/kaevex/blob/main/dashboard/src/pages/Dashboard.tsx"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_native,node_web,node_android,node_mobileviews,node_webviews toneBlue
class node_engine,node_mobileapi,node_webclient,node_androidclient,node_cloudsync toneAmber
class node_network,node_firewall,node_ransom,node_sandbox,node_vulnerability,node_discovery toneMint
class node_ai,node_cluster,node_boot toneRose
class node_windows,node_cloudai,node_supabase,node_operator toneIndigo
```

## Components

### Operator surfaces

- [Native controls](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/gui/kaevex-gui.c): `src/gui/kaevex-gui.c`
- [Web SOC dashboard](https://github.com/mohamed2007sarhan/kaevex/blob/main/dashboard/src/App.tsx): `dashboard/src/App.tsx`
- [Android security app](https://github.com/mohamed2007sarhan/kaevex/blob/main/Application/app/src/main/java/com/kaevex/fireware/ui/navigation/AppNavigation.kt): `Application/app/src/main/java/com/kaevex/fireware/ui/navigation/AppNavigation.kt`
- [Mobile security views](https://github.com/mohamed2007sarhan/kaevex/blob/main/Application/app/src/main/java/com/kaevex/fireware/ui/screens/dashboard/DashboardScreen.kt): `Application/app/src/main/java/com/kaevex/fireware/ui/screens/dashboard/DashboardScreen.kt`
- [SOC dashboards](https://github.com/mohamed2007sarhan/kaevex/blob/main/dashboard/src/pages/Dashboard.tsx): `dashboard/src/pages/Dashboard.tsx`

### Service and data access

- [REST API engine](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/kaevex-engine.c): `src/kaevex-engine.c`
- [Mobile and cluster API](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/mobile_api_engine.h): `src/engines/mobile_api_engine.h`
- [Dashboard API client](https://github.com/mohamed2007sarhan/kaevex/blob/main/dashboard/src/api/client.ts): `dashboard/src/api/client.ts`
- [Android API service](https://github.com/mohamed2007sarhan/kaevex/blob/main/Application/app/src/main/java/com/kaevex/fireware/data/api/KaevexApiService.kt): `Application/app/src/main/java/com/kaevex/fireware/data/api/KaevexApiService.kt`
- [Cloud synchronization](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/supabase_engine.h): `src/engines/supabase_engine.h`

### Endpoint defense

- [Network defense](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/net_engine.h): `src/engines/net_engine.h`
- [Adaptive firewall](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/fw_engine.h): `src/engines/fw_engine.h`
- [RansomShield recovery](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/ransom_engine.h): `src/engines/ransom_engine.h`
- [SmartSandbox isolation](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/sbx_engine.h): `src/engines/sbx_engine.h`
- [CVE agent and updater](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/upd_engine.h): `src/engines/upd_engine.h`
- [Application discovery](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/discovery_engine.h): `src/engines/discovery_engine.h`

### SOC operations

- [AI SOC analysis](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/ai_together_engine.h): `src/engines/ai_together_engine.h`
- [SOC cluster mesh](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/soc_engine.h): `src/engines/soc_engine.h`
- [Bootkit forensics](https://github.com/mohamed2007sarhan/kaevex/blob/main/src/engines/boot_rootkit_engine.h): `src/engines/boot_rootkit_engine.h`

### External integrations

- **Windows endpoint APIs**
- **Cloud AI inference**
- **Supabase services**

### Other components

- **Security operator**

## Connections

- Security operator → Native controls: operates
- Security operator → Web SOC dashboard: operates
- Security operator → Android security app: operates
- Web SOC dashboard → Dashboard API client: requests data
- Web SOC dashboard → SOC dashboards: selects views
- Dashboard API client → REST API engine: calls REST API
- Android security app → Android API service: requests data
- Android security app → Mobile security views: renders screens
- Android API service → Mobile and cluster API: calls REST API
- Native controls → Network defense: controls
- Native controls → Adaptive firewall: controls
- REST API engine → Network defense: serves security data
- REST API engine → Adaptive firewall: dispatches lockdown
- REST API engine → CVE agent and updater: dispatches remediation
- REST API engine → AI SOC analysis: dispatches chat
- REST API engine → SOC cluster mesh: dispatches cluster actions
- REST API engine → Bootkit forensics: serves audit data
- Mobile and cluster API → SOC cluster mesh: manages pairing
- Mobile and cluster API → Network defense: reads threat data
- Network defense → Windows endpoint APIs: inspects connections
- Adaptive firewall → Windows endpoint APIs: enforces rules
- RansomShield recovery → Windows endpoint APIs: monitors files
- RansomShield recovery → Windows endpoint APIs: uses recovery snapshots
- SmartSandbox isolation → Windows endpoint APIs: isolates binaries
- CVE agent and updater → Windows endpoint APIs: inventories and patches
- Application discovery → Windows endpoint APIs: discovers applications
- AI SOC analysis → Cloud AI inference: requests inference
- Cloud synchronization → Supabase services: syncs telemetry
- SOC cluster mesh → SOC cluster mesh: shares threat intelligence