How nehachavan005/threatlens-ai-explainable-cyber-threat-intelligence-response works
ThreatLens AI is a FastAPI intrusion-detection and analyst-guidance application. An operator or network-flow producer submits canonical flow features; the prediction route validates them, runs model inference, and can enrich attack results with SHAP explanations, defensive recommendations, and an optional IBM Granite advisory. Attack alerts and correlated incidents are persisted for alert and dashboard views. The README documents the dashboard’s alert, distribution, timeline, and attacker visualizations. Edges are limited to README statements and shown source/index references; some internal dashboard and service wiring was not sampled.
Main entry points: predictions.py Prediction routes · main.py FastAPI entry · explainability.py Explain routes · dashboard.py Dashboard routes
Components 21
API and input
- FastAPI entry
app/main.py - Prediction routes
app/api/predictions.py - Explain routes
app/api/explainability.py - Alert routes
app/api/alerts.py - Dashboard routes
app/api/dashboard.py - Flow validation
app/schemas/requests.py - Response models
app/schemas/responses.py
Detection and explanation
- Model inference
app/services/inference_service.py - SHAP attribution
app/services/shap_service.py - Explanation synthesis
app/services/explainable_ai.py
Alert and response
- Action recommendations
app/services/defensive_action_service.py - GenAI advisory
app/services/genai_service.py - Alert notifications
app/services/notification_service.py - Alert and incidents
app/services/alert_service.py
Persistence and dashboard
- Database sessions
app/database/session.py - Alert and incident models
app/database/models.py - SQLite database
- Live dashboard
app/static/app.js
Other components
- Flow producer
- Security analyst
- IBM Granite
Connections 29
- Flow producer → Prediction routes: submits flows
README.md - Security analyst → Live dashboard: views alerts
README.md - FastAPI entry → Prediction routes: registers route
app/main.py - FastAPI entry → Explain routes: registers route
app/main.py - FastAPI entry → Alert routes: registers route
app/main.py - FastAPI entry → Dashboard routes: registers route
app/main.py - FastAPI entry → Database sessions: initializes database
app/main.py - Prediction routes → Flow validation: accepts features
app/api/predictions.py - Prediction routes → Model inference: predicts flow
app/api/predictions.py - Prediction routes → SHAP attribution: requests attribution
app/api/predictions.py - Prediction routes → Explanation synthesis: builds explanation
app/api/predictions.py - Prediction routes → Action recommendations: requests actions
app/api/predictions.py - Prediction routes → GenAI advisory: requests advisory
app/api/predictions.py - GenAI advisory → IBM Granite: requests generation
- Prediction routes → Alert and incidents: creates attack alert
app/api/predictions.py - Prediction routes → Alert notifications: sends notification
app/api/predictions.py - Prediction routes → Response models: returns result
app/api/predictions.py - Explain routes → Model inference: uses prediction
app/api/explainability.py - Explain routes → SHAP attribution: requests attribution
app/api/explainability.py - Explain routes → Explanation synthesis: builds explanation
app/api/explainability.py - Explain routes → GenAI advisory: requests advisory
app/api/explainability.py - Alert routes → Alert and incidents: manages alerts
app/api/alerts.py - Alert routes → Action recommendations: requests actions
app/api/alerts.py - Dashboard routes → Database sessions: queries data
app/api/dashboard.py - Alert and incidents → Alert and incident models: queries and writes
app/services/alert_service.py - Database sessions → Alert and incident models: creates tables
app/database/session.py - Database sessions → SQLite database: connects
app/database/session.py - Live dashboard → Dashboard routes: loads dashboard data
- Dashboard routes → Response models: formats responses
app/api/dashboard.py