How nonchalant-scholar/cybertwin works
CyberTwin is a local educational security-monitoring dashboard. An analyst selects a synthetic login scenario; the app generates events, sorts them, evaluates configured rules, and presents event statistics, alerts, evidence, and an investigation timeline. The analyst can then record a simulated response, which updates in-memory defensive state and history. The graph preserves these distinct stages and dashboard capabilities. Relationships are based on the shown app, simulator, detector, and response excerpts or README statements; unsampled implementation details are not inferred.
Main entry points: app.py Streamlit Dashboard · response.py Response Simulator · simulator.py Event Generator · detector.py Rule-Based Detection
Components 16
Dashboard & Investigation
- Streamlit Dashboard
app.py - Scenario Selection
app.py - Event Sorting
app.py - Event Metrics & Chart
app.py - Alert Evidence & Actions
app.py - Investigation Timeline
app.py - Investigation Summary
app.py
Simulation & Detection
- Event Generator
simulator.py - Synthetic Login Events
simulator.py - Rule-Based Detection
detector.py - Detection Alerts
detector.py
Simulated Response
- Response Action
app.py - Response Simulator
response.py - In-Memory State
app.py - Response History View
app.py
Other components
- Analyst
Connections 18
- Analyst → Scenario Selection: selects
README.md - Scenario Selection → Streamlit Dashboard: submits to
README.md - Streamlit Dashboard → Event Generator: calls
app.py - Event Generator → Synthetic Login Events: generates
simulator.py - Synthetic Login Events → Event Sorting: provides events
app.py - Event Sorting → Rule-Based Detection: passes events
app.py - Rule-Based Detection → Detection Alerts: returns alerts
detector.py - Streamlit Dashboard → Event Metrics & Chart: displays
app.py - Detection Alerts → Alert Evidence & Actions: displays evidence
app.py - Event Sorting → Investigation Timeline: filters and sorts
app.py - Alert Evidence & Actions → Investigation Timeline: reviews related events
app.py - Investigation Timeline → Investigation Summary: summarizes
README.md - Analyst → Response Action: chooses action
README.md - Response Action → Response Simulator: calls
app.py - Alert Evidence & Actions → Response Simulator: provides alert
app.py - Response Simulator → In-Memory State: updates
response.py - Streamlit Dashboard → In-Memory State: resets and displays
app.py - In-Memory State → Response History View: supplies history
app.py