# nandikasharma11/project-logs architecture

> Architecture diagram of the GitHub repository nandikasharma11/project-logs, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nandikasharma11/project-logs
- Repository: https://github.com/nandikasharma11/project-logs

## Overview

This is a Windows EVTX forensic-analysis application: investigators convert event logs, inspect evidence, and ask cited natural-language questions over the resulting records. The documented preparation path normalizes logs, clusters repeated events while retaining record mappings, and builds template and entity-correlation indexes. Querying combines parsed filters, vector search, SQL filtering and correlated evidence before the retrieval layer assembles context and generates an answer; Streamlit presents the workflow and event details. The README documents the layer order; sampled excerpts do not establish every runtime call, so uncertain wiring is omitted.

Main entry points: [`retrieval_pipeline.py`](https://github.com/nandikasharma11/project-logs/blob/approach1/retrieval_pipeline.py) (Retrieval Orchestrator), [`app.py`](https://github.com/nandikasharma11/project-logs/blob/approach1/app.py) (Streamlit Dashboard), [`fileconversion.py`](https://github.com/nandikasharma11/project-logs/blob/approach1/fileconversion.py) (EVTX Converter), [`log_templater.py`](https://github.com/nandikasharma11/project-logs/blob/approach1/log_templater.py) (Template Clustering)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ui["Investigation UI"]
  node_dashboard["Streamlit Dashboard<br/>[app.py]"]
end

subgraph group_ingest["Ingestion"]
  node_converter["EVTX Converter<br/>[fileconversion.py]"]
  node_canonical_logs[("Canonical Logs")]
end

subgraph group_evidence["Evidence Preparation"]
  node_transformer["Contextual Chunking<br/>[log_transformer.py]"]
  node_templater["Template Clustering<br/>[log_templater.py]"]
  node_derived_tables[("Template Records<br/>[log_templater.py]")]
  node_vectorizer["Template Vector Indexer"]
  node_correlator["Entity Correlation Indexer"]
  node_correlation_index[("Correlation Index")]
end

subgraph group_query["Retrieval and Reasoning"]
  node_retrieval["Retrieval Orchestrator"]
  node_parser["Query Parser<br/>[query_parser.py]"]
  node_executor["Hybrid Query Executor<br/>[query_executor.py]"]
  node_answer["Cited Findings"]
end

node_investigator(("Investigator"))
node_evtx_files["EVTX Files"]
node_qdrant[("Qdrant Index")]
node_llm["LLM Backend"]

node_investigator -->|"uses"| node_dashboard
node_evtx_files -->|"converts"| node_converter
node_dashboard -->|"invokes"| node_converter
node_converter -->|"writes records"| node_canonical_logs
node_dashboard -->|"submits query"| node_retrieval
node_canonical_logs -->|"reads records"| node_transformer
node_canonical_logs -->|"reads records"| node_templater
node_templater -->|"writes mappings"| node_derived_tables
node_derived_tables -->|"supplies templates"| node_vectorizer
node_vectorizer -->|"indexes vectors"| node_qdrant
node_canonical_logs -->|"reads records"| node_correlator
node_correlator -->|"writes links"| node_correlation_index
node_retrieval -->|"parses query"| node_parser
node_retrieval -->|"executes filters"| node_executor
node_retrieval -->|"searches templates"| node_qdrant
node_retrieval -->|"reads links"| node_correlation_index
node_retrieval -->|"loads evidence"| node_canonical_logs
node_retrieval -->|"generates reasoning"| node_llm
node_llm -->|"returns answer"| node_retrieval
node_retrieval -->|"assembles citations"| node_answer
node_retrieval -->|"returns findings"| node_dashboard

click node_dashboard "https://github.com/nandikasharma11/project-logs/blob/approach1/app.py"
click node_converter "https://github.com/nandikasharma11/project-logs/blob/approach1/fileconversion.py"
click node_transformer "https://github.com/nandikasharma11/project-logs/blob/approach1/log_transformer.py"
click node_templater "https://github.com/nandikasharma11/project-logs/blob/approach1/log_templater.py"
click node_derived_tables "https://github.com/nandikasharma11/project-logs/blob/approach1/log_templater.py"
click node_vectorizer "https://github.com/nandikasharma11/project-logs/blob/approach1/stage3_vectorizing.py"
click node_correlator "https://github.com/nandikasharma11/project-logs/blob/approach1/correlation_indexer.py"
click node_correlation_index "https://github.com/nandikasharma11/project-logs/blob/approach1/correlation_indexer.py"
click node_retrieval "https://github.com/nandikasharma11/project-logs/blob/approach1/retrieval_pipeline.py"
click node_parser "https://github.com/nandikasharma11/project-logs/blob/approach1/query_parser.py"
click node_executor "https://github.com/nandikasharma11/project-logs/blob/approach1/query_executor.py"
click node_answer "https://github.com/nandikasharma11/project-logs/blob/approach1/retrieval_pipeline.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_dashboard toneBlue
class node_converter,node_canonical_logs,node_qdrant toneAmber
class node_transformer,node_templater,node_derived_tables,node_vectorizer,node_correlator,node_correlation_index toneMint
class node_retrieval,node_parser,node_executor,node_answer toneRose
class node_investigator,node_evtx_files,node_llm toneIndigo
```

## Components

### Investigation UI

- [Streamlit Dashboard](https://github.com/nandikasharma11/project-logs/blob/approach1/app.py): `app.py`

### Ingestion

- [EVTX Converter](https://github.com/nandikasharma11/project-logs/blob/approach1/fileconversion.py): `fileconversion.py`
- **Canonical Logs**

### Evidence Preparation

- [Contextual Chunking](https://github.com/nandikasharma11/project-logs/blob/approach1/log_transformer.py): `log_transformer.py`
- [Template Clustering](https://github.com/nandikasharma11/project-logs/blob/approach1/log_templater.py): `log_templater.py`
- [Template Records](https://github.com/nandikasharma11/project-logs/blob/approach1/log_templater.py): `log_templater.py`
- [Template Vector Indexer](https://github.com/nandikasharma11/project-logs/blob/approach1/stage3_vectorizing.py): `stage3_vectorizing.py`
- [Entity Correlation Indexer](https://github.com/nandikasharma11/project-logs/blob/approach1/correlation_indexer.py): `correlation_indexer.py`
- [Correlation Index](https://github.com/nandikasharma11/project-logs/blob/approach1/correlation_indexer.py): `correlation_indexer.py`

### Retrieval and Reasoning

- [Retrieval Orchestrator](https://github.com/nandikasharma11/project-logs/blob/approach1/retrieval_pipeline.py): `retrieval_pipeline.py`
- [Query Parser](https://github.com/nandikasharma11/project-logs/blob/approach1/query_parser.py): `query_parser.py`
- [Hybrid Query Executor](https://github.com/nandikasharma11/project-logs/blob/approach1/query_executor.py): `query_executor.py`
- [Cited Findings](https://github.com/nandikasharma11/project-logs/blob/approach1/retrieval_pipeline.py): `retrieval_pipeline.py`

### Other components

- **Investigator**
- **EVTX Files**
- **Qdrant Index**
- **LLM Backend**

## Connections

- Investigator → Streamlit Dashboard: uses
- EVTX Files → EVTX Converter: converts
- Streamlit Dashboard → EVTX Converter: invokes
- EVTX Converter → Canonical Logs: writes records
- Streamlit Dashboard → Retrieval Orchestrator: submits query
- Canonical Logs → Contextual Chunking: reads records
- Canonical Logs → Template Clustering: reads records
- Template Clustering → Template Records: writes mappings
- Template Records → Template Vector Indexer: supplies templates
- Template Vector Indexer → Qdrant Index: indexes vectors
- Canonical Logs → Entity Correlation Indexer: reads records
- Entity Correlation Indexer → Correlation Index: writes links
- Retrieval Orchestrator → Query Parser: parses query
- Retrieval Orchestrator → Hybrid Query Executor: executes filters
- Retrieval Orchestrator → Qdrant Index: searches templates
- Retrieval Orchestrator → Correlation Index: reads links
- Retrieval Orchestrator → Canonical Logs: loads evidence
- Retrieval Orchestrator → LLM Backend: generates reasoning
- LLM Backend → Retrieval Orchestrator: returns answer
- Retrieval Orchestrator → Cited Findings: assembles citations
- Retrieval Orchestrator → Streamlit Dashboard: returns findings