# nonchalant-scholar/cybertwin architecture

> Architecture diagram of the GitHub repository nonchalant-scholar/cybertwin, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nonchalant-scholar/cybertwin
- Repository: https://github.com/nonchalant-scholar/cybertwin

## Overview

CyberTwin is a local educational security-monitoring dashboard. An analyst selects a synthetic login scenario; the app generates events, sorts them, evaluates configured rules, and presents event statistics, alerts, evidence, and an investigation timeline. The analyst can then record a simulated response, which updates in-memory defensive state and history. The graph preserves these distinct stages and dashboard capabilities. Relationships are based on the shown app, simulator, detector, and response excerpts or README statements; unsampled implementation details are not inferred.

Main entry points: [`app.py`](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py) (Streamlit Dashboard), [`response.py`](https://github.com/nonchalant-scholar/cybertwin/blob/main/response.py) (Response Simulator), [`simulator.py`](https://github.com/nonchalant-scholar/cybertwin/blob/main/simulator.py) (Event Generator), [`detector.py`](https://github.com/nonchalant-scholar/cybertwin/blob/main/detector.py) (Rule-Based Detection)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_dashboard["Dashboard & Investigation"]
  node_dashboard["Streamlit Dashboard<br/>[app.py]"]
  node_scenario["Scenario Selection<br/>[app.py]"]
  node_event_preparation["Event Sorting<br/>[app.py]"]
  node_event_overview["Event Metrics &amp; Chart<br/>[app.py]"]
  node_alert_review["Alert Evidence &amp; Actions<br/>[app.py]"]
  node_timeline["Investigation Timeline<br/>[app.py]"]
  node_investigation_summary["Investigation Summary<br/>[app.py]"]
end

subgraph group_analysis["Simulation &amp; Detection"]
  node_generator["Event Generator<br/>[simulator.py]"]
  node_events["Synthetic Login Events<br/>[simulator.py]"]
  node_detector["Rule-Based Detection<br/>[detector.py]"]
  node_alerts["Detection Alerts<br/>[detector.py]"]
end

subgraph group_response["Simulated Response"]
  node_response_choice["Response Action<br/>[app.py]"]
  node_response_handler["Response Simulator<br/>[response.py]"]
  node_response_state[("In-Memory State<br/>[app.py]")]
  node_response_history["Response History View<br/>[app.py]"]
end

node_analyst(("Analyst"))

node_analyst -->|"selects"| node_scenario
node_scenario -->|"submits to"| node_dashboard
node_dashboard -->|"calls"| node_generator
node_generator -->|"generates"| node_events
node_events -->|"provides events"| node_event_preparation
node_event_preparation -->|"passes events"| node_detector
node_detector -->|"returns alerts"| node_alerts
node_dashboard -->|"displays"| node_event_overview
node_alerts -->|"displays evidence"| node_alert_review
node_event_preparation -->|"filters and sorts"| node_timeline
node_alert_review -->|"reviews related events"| node_timeline
node_timeline -->|"summarizes"| node_investigation_summary
node_analyst -->|"chooses action"| node_response_choice
node_response_choice -->|"calls"| node_response_handler
node_alert_review -->|"provides alert"| node_response_handler
node_response_handler -->|"updates"| node_response_state
node_dashboard -->|"resets and displays"| node_response_state
node_response_state -->|"supplies history"| node_response_history

click node_dashboard "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_scenario "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_generator "https://github.com/nonchalant-scholar/cybertwin/blob/main/simulator.py"
click node_events "https://github.com/nonchalant-scholar/cybertwin/blob/main/simulator.py"
click node_event_preparation "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_detector "https://github.com/nonchalant-scholar/cybertwin/blob/main/detector.py"
click node_alerts "https://github.com/nonchalant-scholar/cybertwin/blob/main/detector.py"
click node_event_overview "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_alert_review "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_timeline "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_investigation_summary "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_response_choice "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_response_handler "https://github.com/nonchalant-scholar/cybertwin/blob/main/response.py"
click node_response_state "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"
click node_response_history "https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_dashboard,node_scenario,node_event_preparation,node_event_overview,node_alert_review,node_timeline,node_investigation_summary toneBlue
class node_generator,node_events,node_detector,node_alerts toneAmber
class node_response_choice,node_response_handler,node_response_state,node_response_history toneMint
class node_analyst toneIndigo
```

## Components

### Dashboard & Investigation

- [Streamlit Dashboard](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`
- [Scenario Selection](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`
- [Event Sorting](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`
- [Event Metrics & Chart](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`
- [Alert Evidence & Actions](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`
- [Investigation Timeline](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`
- [Investigation Summary](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`

### Simulation & Detection

- [Event Generator](https://github.com/nonchalant-scholar/cybertwin/blob/main/simulator.py): `simulator.py`
- [Synthetic Login Events](https://github.com/nonchalant-scholar/cybertwin/blob/main/simulator.py): `simulator.py`
- [Rule-Based Detection](https://github.com/nonchalant-scholar/cybertwin/blob/main/detector.py): `detector.py`
- [Detection Alerts](https://github.com/nonchalant-scholar/cybertwin/blob/main/detector.py): `detector.py`

### Simulated Response

- [Response Action](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`
- [Response Simulator](https://github.com/nonchalant-scholar/cybertwin/blob/main/response.py): `response.py`
- [In-Memory State](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`
- [Response History View](https://github.com/nonchalant-scholar/cybertwin/blob/main/app.py): `app.py`

### Other components

- **Analyst**

## Connections

- Analyst → Scenario Selection: selects (evidence: `README.md`)
- Scenario Selection → Streamlit Dashboard: submits to (evidence: `README.md`)
- Streamlit Dashboard → Event Generator: calls (evidence: `app.py`)
- Event Generator → Synthetic Login Events: generates (evidence: `simulator.py`)
- Synthetic Login Events → Event Sorting: provides events (evidence: `app.py`)
- Event Sorting → Rule-Based Detection: passes events (evidence: `app.py`)
- Rule-Based Detection → Detection Alerts: returns alerts (evidence: `detector.py`)
- Streamlit Dashboard → Event Metrics & Chart: displays (evidence: `app.py`)
- Detection Alerts → Alert Evidence & Actions: displays evidence (evidence: `app.py`)
- Event Sorting → Investigation Timeline: filters and sorts (evidence: `app.py`)
- Alert Evidence & Actions → Investigation Timeline: reviews related events (evidence: `app.py`)
- Investigation Timeline → Investigation Summary: summarizes (evidence: `README.md`)
- Analyst → Response Action: chooses action (evidence: `README.md`)
- Response Action → Response Simulator: calls (evidence: `app.py`)
- Alert Evidence & Actions → Response Simulator: provides alert (evidence: `app.py`)
- Response Simulator → In-Memory State: updates (evidence: `response.py`)
- Streamlit Dashboard → In-Memory State: resets and displays (evidence: `app.py`)
- In-Memory State → Response History View: supplies history (evidence: `app.py`)