# monstertsl/sensemind architecture

> Architecture diagram of the GitHub repository monstertsl/sensemind, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/monstertsl/sensemind
- Repository: https://github.com/monstertsl/sensemind

## Overview

SenseMind is an AI-assisted SOC platform: network alerts and protocol logs are collected and classified, selected alerts are analyzed and correlated with surrounding events, and results appear in a web console; confirmed attacks can feed generated Suricata rules back into detection. The graph preserves the README’s documented collection pipeline and five analysis stages, but their deployment configuration is not present in the supplied tree. Sampled backend code supports the webhook, query, correlation, persistence, and RAG links; unsampled subsystem wiring is shown only where documented.

Main entry points: [`ai-analyzer/app/analyzer.py`](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/analyzer.py) (Alert analyzer), [`web/src/api`](https://github.com/monstertsl/sensemind/tree/main/web/src/api) (Web API clients), [`web/src/App.vue`](https://github.com/monstertsl/sensemind/blob/main/web/src/App.vue) (SenseMind web app), [`ai-analyzer/app/main.py`](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/main.py) (Alert webhook)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Collection & detection"]
  node_sensors["Suricata + Zeek"]
  node_ingest["Filebeat / Logstash"]
  node_elastic[("Elasticsearch")]
end

subgraph group_analysis["AI analysis"]
  node_dedup["Alert dedup<br/>[dedup.py]"]
  node_analyzer["Alert analyzer<br/>[analyzer.py]"]
  node_stages["Analysis chains"]
  node_correlation["Related-log lookup<br/>[es_client.py]"]
  node_rag["Knowledge retrieval<br/>[rag.py]"]
  node_rulegen["Rule generation<br/>[rule_generator.py]"]
  node_rulewriter["Suricata rule writer<br/>[rule_writer.py]"]
end

subgraph group_backend["API &amp; state"]
  node_webhook["Alert webhook<br/>[main.py]"]
  node_rulelookup["Rule lookup<br/>[rule_lookup.py]"]
  node_resultstore["Analysis persistence<br/>[es_client.py]"]
  node_queryapi["Alert query API<br/>[query.py]"]
  node_queryservice["Alert query service<br/>[query_service.py]"]
  node_metricsapi["Metrics API<br/>[metrics.py]"]
  node_metricquery["Metric queries<br/>[metric_query.py]"]
  node_postgres[("PostgreSQL<br/>[database.py]")]
end

subgraph group_console["Web console"]
  node_webapp["SenseMind web app<br/>[App.vue]"]
  node_analysisui["Alert analysis<br/>[AnalysisAlerts.vue]"]
  node_logui["Log explorer<br/>[LogExplorer.vue]"]
  node_monitorui["Monitor dashboard"]
  node_settingsui["System settings<br/>[SystemSettings.vue]"]
  node_frontendapis["Web API clients"]
end

node_analyst(("SOC analyst"))

node_sensors -->|"ship events"| node_ingest
node_ingest -->|"index events"| node_elastic
node_ingest -->|"push matched alerts"| node_webhook
node_webhook -->|"check duplicates"| node_dedup
node_webhook -->|"analyze alert"| node_analyzer
node_analyzer -->|"run stages"| node_stages
node_analyzer -->|"fetch related logs"| node_correlation
node_correlation -->|"query events"| node_elastic
node_analyzer -->|"retrieve knowledge"| node_rag
node_analyzer -->|"write analysis"| node_resultstore
node_resultstore -->|"index result"| node_elastic
node_analyzer -->|"generate rule"| node_rulegen
node_rulegen -->|"write rule"| node_rulewriter
node_rulewriter -->|"reload rules"| node_sensors
node_queryapi -->|"delegate queries"| node_queryservice
node_queryservice -->|"read alerts"| node_elastic
node_queryapi -->|"fetch rule content"| node_rulelookup
node_metricsapi -->|"query metrics"| node_metricquery
node_metricquery -->|"read metrics"| node_postgres
node_analyst -->|"use console"| node_webapp
node_webapp -->|"navigate"| node_analysisui
node_webapp -->|"navigate"| node_logui
node_webapp -->|"navigate"| node_monitorui
node_webapp -->|"navigate"| node_settingsui
node_analysisui -->|"request alerts"| node_frontendapis
node_logui -->|"search logs"| node_frontendapis
node_monitorui -->|"request metrics"| node_frontendapis
node_settingsui -->|"manage settings"| node_frontendapis
node_frontendapis -->|"call alert API"| node_queryapi
node_frontendapis -->|"call metrics API"| node_metricsapi
node_analysisui -->|"cross-page navigation"| node_logui

click node_webhook "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/main.py"
click node_dedup "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/dedup.py"
click node_analyzer "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/analyzer.py"
click node_stages "https://github.com/monstertsl/sensemind/tree/main/ai-analyzer/app/chains"
click node_correlation "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/es_client.py"
click node_rag "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/knowledge/rag.py"
click node_rulegen "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/chains/rule_generator.py"
click node_rulewriter "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/suricata/rule_writer.py"
click node_rulelookup "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/suricata/rule_lookup.py"
click node_resultstore "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/es_client.py"
click node_queryapi "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/routers/query.py"
click node_queryservice "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/services/query_service.py"
click node_metricsapi "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/routers/metrics.py"
click node_metricquery "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/services/metric_query.py"
click node_postgres "https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/core/database.py"
click node_webapp "https://github.com/monstertsl/sensemind/blob/main/web/src/App.vue"
click node_analysisui "https://github.com/monstertsl/sensemind/blob/main/web/src/pages/AnalysisAlerts.vue"
click node_logui "https://github.com/monstertsl/sensemind/blob/main/web/src/pages/LogExplorer.vue"
click node_monitorui "https://github.com/monstertsl/sensemind/blob/main/web/src/pages/MonitorDashboard.vue"
click node_settingsui "https://github.com/monstertsl/sensemind/blob/main/web/src/pages/SystemSettings.vue"
click node_frontendapis "https://github.com/monstertsl/sensemind/tree/main/web/src/api"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_sensors,node_ingest,node_elastic toneBlue
class node_dedup,node_analyzer,node_stages,node_correlation,node_rag,node_rulegen,node_rulewriter toneAmber
class node_webhook,node_rulelookup,node_resultstore,node_queryapi,node_queryservice,node_metricsapi,node_metricquery,node_postgres toneMint
class node_webapp,node_analysisui,node_logui,node_monitorui,node_settingsui,node_frontendapis toneRose
class node_analyst toneIndigo
```

## Components

### Collection & detection

- **Suricata + Zeek**
- **Filebeat / Logstash**
- **Elasticsearch**

### AI analysis

- [Alert dedup](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/dedup.py): `ai-analyzer/app/dedup.py`
- [Alert analyzer](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/analyzer.py): `ai-analyzer/app/analyzer.py`
- [Analysis chains](https://github.com/monstertsl/sensemind/tree/main/ai-analyzer/app/chains): `ai-analyzer/app/chains`
- [Related-log lookup](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/es_client.py): `ai-analyzer/app/es_client.py`
- [Knowledge retrieval](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/knowledge/rag.py): `ai-analyzer/app/knowledge/rag.py`
- [Rule generation](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/chains/rule_generator.py): `ai-analyzer/app/chains/rule_generator.py`
- [Suricata rule writer](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/suricata/rule_writer.py): `ai-analyzer/app/suricata/rule_writer.py`

### API & state

- [Alert webhook](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/main.py): `ai-analyzer/app/main.py`
- [Rule lookup](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/suricata/rule_lookup.py): `ai-analyzer/app/suricata/rule_lookup.py`
- [Analysis persistence](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/es_client.py): `ai-analyzer/app/es_client.py`
- [Alert query API](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/routers/query.py): `ai-analyzer/app/routers/query.py`
- [Alert query service](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/services/query_service.py): `ai-analyzer/app/services/query_service.py`
- [Metrics API](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/routers/metrics.py): `ai-analyzer/app/routers/metrics.py`
- [Metric queries](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/services/metric_query.py): `ai-analyzer/app/services/metric_query.py`
- [PostgreSQL](https://github.com/monstertsl/sensemind/blob/main/ai-analyzer/app/core/database.py): `ai-analyzer/app/core/database.py`

### Web console

- [SenseMind web app](https://github.com/monstertsl/sensemind/blob/main/web/src/App.vue): `web/src/App.vue`
- [Alert analysis](https://github.com/monstertsl/sensemind/blob/main/web/src/pages/AnalysisAlerts.vue): `web/src/pages/AnalysisAlerts.vue`
- [Log explorer](https://github.com/monstertsl/sensemind/blob/main/web/src/pages/LogExplorer.vue): `web/src/pages/LogExplorer.vue`
- [Monitor dashboard](https://github.com/monstertsl/sensemind/blob/main/web/src/pages/MonitorDashboard.vue): `web/src/pages/MonitorDashboard.vue`
- [System settings](https://github.com/monstertsl/sensemind/blob/main/web/src/pages/SystemSettings.vue): `web/src/pages/SystemSettings.vue`
- [Web API clients](https://github.com/monstertsl/sensemind/tree/main/web/src/api): `web/src/api`

### Other components

- **SOC analyst**

## Connections

- Suricata + Zeek → Filebeat / Logstash: ship events
- Filebeat / Logstash → Elasticsearch: index events
- Filebeat / Logstash → Alert webhook: push matched alerts
- Alert webhook → Alert dedup: check duplicates
- Alert webhook → Alert analyzer: analyze alert
- Alert analyzer → Analysis chains: run stages
- Alert analyzer → Related-log lookup: fetch related logs
- Related-log lookup → Elasticsearch: query events
- Alert analyzer → Knowledge retrieval: retrieve knowledge
- Alert analyzer → Analysis persistence: write analysis
- Analysis persistence → Elasticsearch: index result
- Alert analyzer → Rule generation: generate rule
- Rule generation → Suricata rule writer: write rule
- Suricata rule writer → Suricata + Zeek: reload rules
- Alert query API → Alert query service: delegate queries
- Alert query service → Elasticsearch: read alerts
- Alert query API → Rule lookup: fetch rule content
- Metrics API → Metric queries: query metrics
- Metric queries → PostgreSQL: read metrics
- SOC analyst → SenseMind web app: use console
- SenseMind web app → Alert analysis: navigate
- SenseMind web app → Log explorer: navigate
- SenseMind web app → Monitor dashboard: navigate
- SenseMind web app → System settings: navigate
- Alert analysis → Web API clients: request alerts
- Log explorer → Web API clients: search logs
- Monitor dashboard → Web API clients: request metrics
- System settings → Web API clients: manage settings
- Web API clients → Alert query API: call alert API
- Web API clients → Metrics API: call metrics API
- Alert analysis → Log explorer: cross-page navigation