How monstertsl/sensemind works
SenseMind is an AI-assisted SOC platform: network alerts and protocol logs are collected and classified, selected alerts are analyzed and correlated with surrounding events, and results appear in a web console; confirmed attacks can feed generated Suricata rules back into detection. The graph preserves the README’s documented collection pipeline and five analysis stages, but their deployment configuration is not present in the supplied tree. Sampled backend code supports the webhook, query, correlation, persistence, and RAG links; unsampled subsystem wiring is shown only where documented.
Main entry points: analyzer.py Alert analyzer · api Web API clients · App.vue SenseMind web app · main.py Alert webhook
Components 25
Collection & detection
- Suricata + Zeek
- Filebeat / Logstash
- Elasticsearch
AI analysis
- Alert dedup
ai-analyzer/app/dedup.py - Alert analyzer
ai-analyzer/app/analyzer.py - Analysis chains
ai-analyzer/app/chains - Related-log lookup
ai-analyzer/app/es_client.py - Knowledge retrieval
ai-analyzer/app/knowledge/rag.py - Rule generation
ai-analyzer/app/chains/rule_generator.py - Suricata rule writer
ai-analyzer/app/suricata/rule_writer.py
API & state
- Alert webhook
ai-analyzer/app/main.py - Rule lookup
ai-analyzer/app/suricata/rule_lookup.py - Analysis persistence
ai-analyzer/app/es_client.py - Alert query API
ai-analyzer/app/routers/query.py - Alert query service
ai-analyzer/app/services/query_service.py - Metrics API
ai-analyzer/app/routers/metrics.py - Metric queries
ai-analyzer/app/services/metric_query.py - PostgreSQL
ai-analyzer/app/core/database.py
Web console
- SenseMind web app
web/src/App.vue - Alert analysis
web/src/pages/AnalysisAlerts.vue - Log explorer
web/src/pages/LogExplorer.vue - Monitor dashboard
web/src/pages/MonitorDashboard.vue - System settings
web/src/pages/SystemSettings.vue - Web API clients
web/src/api
Other components
- SOC analyst
Connections 31
- Suricata + Zeek → Filebeat / Logstash: ship events
- Filebeat / Logstash → Elasticsearch: index events
- Filebeat / Logstash → Alert webhook: push matched alerts
- Alert webhook → Alert dedup: check duplicates
- Alert webhook → Alert analyzer: analyze alert
- Alert analyzer → Analysis chains: run stages
- Alert analyzer → Related-log lookup: fetch related logs
- Related-log lookup → Elasticsearch: query events
- Alert analyzer → Knowledge retrieval: retrieve knowledge
- Alert analyzer → Analysis persistence: write analysis
- Analysis persistence → Elasticsearch: index result
- Alert analyzer → Rule generation: generate rule
- Rule generation → Suricata rule writer: write rule
- Suricata rule writer → Suricata + Zeek: reload rules
- Alert query API → Alert query service: delegate queries
- Alert query service → Elasticsearch: read alerts
- Alert query API → Rule lookup: fetch rule content
- Metrics API → Metric queries: query metrics
- Metric queries → PostgreSQL: read metrics
- SOC analyst → SenseMind web app: use console
- SenseMind web app → Alert analysis: navigate
- SenseMind web app → Log explorer: navigate
- SenseMind web app → Monitor dashboard: navigate
- SenseMind web app → System settings: navigate
- Alert analysis → Web API clients: request alerts
- Log explorer → Web API clients: search logs
- Monitor dashboard → Web API clients: request metrics
- System settings → Web API clients: manage settings
- Web API clients → Alert query API: call alert API
- Web API clients → Metrics API: call metrics API
- Alert analysis → Log explorer: cross-page navigation