# org-software-ciber-2627/software-ciber-2627 architecture
> Architecture diagram of the GitHub repository org-software-ciber-2627/software-ciber-2627, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.
- Interactive diagram: https://gitdiagram.com/org-software-ciber-2627/software-ciber-2627
- Repository: https://github.com/org-software-ciber-2627/software-ciber-2627
## Overview
Ciberurjc is a monorepo for a mini-SOC assembled from eight security modules. Its documented capabilities span identity/secrets, intrusion detection, honeypot capture, vulnerability scanning and pentesting, SIEM event and alert handling, SOAR incident response, and a dashboard. A typical supported path is a honeypot login or FTP attempt being classified, persisted, mapped to an event, and sent to the SIEM; the SIEM persists events and may create and emit alerts. The README describes the broader integrated product, but most cross-module wiring is not shown in the excerpts, so those links are omitted.
Main entry points: [`modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java`](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java) (Web Honeypot), [`modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java`](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java) (FTP Event Capture), [`modules/02-ids/src/main.py`](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/main.py) (IDS Runtime), [`modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventService.java`](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventService.java) (Event Processing)
## Diagram (Mermaid)
```mermaid
flowchart TD
subgraph group_sensors["Identity and Sensing"]
node_identity["Identity and Secrets
[app.py]"]
node_identity_crypto["Secret Cryptography
[crypto.py]"]
node_ids["IDS Runtime
[main.py]"]
node_ids_logparse["Log Parsing
[log_parser.py]"]
node_ids_rules["IDS Rules
[parsers.py]"]
node_ids_storage[("Parsed Log Storage
[log_storage.py]")]
node_honeypot_web["Web Honeypot"]
node_honeypot_ftp["FTP Event Capture"]
node_attack_classifier["Attack Classifier"]
node_attempt_store[("Login Attempt Store")]
node_event_mapper["Event Mapper
[EventoMapper.java]"]
node_honeypot_siem_sender["SIEM Sender"]
node_scanner["Vulnerability Scanner
[main.py]"]
node_scanner_parser["Scan Result Parser
[parser.py]"]
node_pentesting["External Pentesting"]
end
subgraph group_siem["Event Management"]
node_siem_ingest["Event Processing
[EventService.java]"]
node_event_store[("Event Repository")]
node_alert_handling["Alert Handling
[AlertService.java]"]
node_alert_store[("Alert Repository")]
node_alert_queries["Alert Queries"]
node_event_history["Event History"]
node_history_api["History Endpoint"]
end
subgraph group_soar["Incident Response"]
node_soar["SOAR Incident Response
[app.py]"]
node_soar_playbooks["Brute Force Playbook
[entrada.py]"]
node_soar_incidents["Incident Services"]
node_soar_status["Status History
[status_service.py]"]
end
subgraph group_dashboard["Operator Interface"]
node_dashboard["Dashboard
[SIEM-client.js]"]
node_dashboard_auth["Dashboard Authentication
[auth-client.js]"]
end
node_attacker(("Attacker"))
node_operator(("SOC Operator"))
node_siem_service["SIEM Service"]
node_identity -->|"uses"| node_identity_crypto
node_ids -->|"parses logs"| node_ids_logparse
node_ids -->|"loads rules"| node_ids_rules
node_ids -->|"saves parsed logs"| node_ids_storage
node_attacker -.->|"submits login"| node_honeypot_web
node_honeypot_web -->|"classifies attempt"| node_attack_classifier
node_honeypot_web -->|"saves attempt"| node_attempt_store
node_honeypot_web -->|"maps event"| node_event_mapper
node_honeypot_web -->|"sends event"| node_honeypot_siem_sender
node_honeypot_ftp -->|"classifies attempt"| node_attack_classifier
node_honeypot_ftp -->|"saves attempt"| node_attempt_store
node_honeypot_ftp -->|"maps event"| node_event_mapper
node_honeypot_ftp -->|"sends event"| node_honeypot_siem_sender
node_honeypot_siem_sender -->|"HTTP POST"| node_siem_service
node_siem_ingest -->|"persists event"| node_event_store
node_siem_ingest -->|"saves alert"| node_alert_store
node_siem_ingest -->|"emits alert"| node_alert_handling
node_alert_queries -->|"queries alerts"| node_alert_store
node_history_api -->|"requests page"| node_event_history
node_event_history -->|"reads events"| node_event_store
node_soar_status -.->|"supports workflow"| node_soar
node_operator -.->|"uses"| node_dashboard
click node_identity "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/01-identidad/src/app.py"
click node_identity_crypto "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/01-identidad/src/crypto.py"
click node_ids "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/main.py"
click node_ids_logparse "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/util/log_parser.py"
click node_ids_rules "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/util/parsers.py"
click node_ids_storage "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/util/log_storage.py"
click node_honeypot_web "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java"
click node_honeypot_ftp "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java"
click node_attack_classifier "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/ClasificadorAtaquesService.java"
click node_attempt_store "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/repository/LoginAttemptRepository.java"
click node_event_mapper "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/EventoMapper.java"
click node_honeypot_siem_sender "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/SiemSenderService.java"
click node_scanner "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/04-escaner/main.py"
click node_scanner_parser "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/04-escaner/parser.py"
click node_pentesting "https://github.com/org-software-ciber-2627/software-ciber-2627/tree/main/modules/08-pentesting"
click node_siem_ingest "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventService.java"
click node_event_store "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/repositories/EventRepository.java"
click node_alert_handling "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertService.java"
click node_alert_store "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertRepository.java"
click node_alert_queries "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertQueryService.java"
click node_event_history "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventHistoryService.java"
click node_history_api "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/controller/EventHistoryController.java"
click node_soar "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/06-soar/src/app.py"
click node_soar_playbooks "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/06-soar/src/playbook-fuerza-bruta/entrada.py"
click node_soar_incidents "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/06-soar/src/soar/services/incident_service.py"
click node_soar_status "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/06-soar/src/soar/services/status_service.py"
click node_dashboard "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/07-dashboard/src/SIEM-client.js"
click node_dashboard_auth "https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/07-dashboard/src/auth-client.js"
classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_identity,node_identity_crypto,node_ids,node_ids_logparse,node_ids_rules,node_ids_storage,node_honeypot_web,node_honeypot_ftp,node_attack_classifier,node_attempt_store,node_event_mapper,node_honeypot_siem_sender,node_scanner,node_scanner_parser,node_pentesting toneBlue
class node_siem_ingest,node_event_store,node_alert_handling,node_alert_store,node_alert_queries,node_event_history,node_history_api toneAmber
class node_soar,node_soar_playbooks,node_soar_incidents,node_soar_status toneMint
class node_dashboard,node_dashboard_auth toneRose
class node_attacker,node_operator,node_siem_service toneIndigo
```
## Components
### Identity and Sensing
- [Identity and Secrets](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/01-identidad/src/app.py): `modules/01-identidad/src/app.py`
- [Secret Cryptography](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/01-identidad/src/crypto.py): `modules/01-identidad/src/crypto.py`
- [IDS Runtime](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/main.py): `modules/02-ids/src/main.py`
- [Log Parsing](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/util/log_parser.py): `modules/02-ids/src/util/log_parser.py`
- [IDS Rules](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/util/parsers.py): `modules/02-ids/src/util/parsers.py`
- [Parsed Log Storage](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/02-ids/src/util/log_storage.py): `modules/02-ids/src/util/log_storage.py`
- [Web Honeypot](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java): `modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java`
- [FTP Event Capture](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java): `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java`
- [Attack Classifier](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/ClasificadorAtaquesService.java): `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/ClasificadorAtaquesService.java`
- [Login Attempt Store](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/repository/LoginAttemptRepository.java): `modules/03-honeypot/src/main/java/com/honeypot/honeypot/repository/LoginAttemptRepository.java`
- [Event Mapper](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/EventoMapper.java): `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/EventoMapper.java`
- [SIEM Sender](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/SiemSenderService.java): `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/SiemSenderService.java`
- [Vulnerability Scanner](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/04-escaner/main.py): `modules/04-escaner/main.py`
- [Scan Result Parser](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/04-escaner/parser.py): `modules/04-escaner/parser.py`
- [External Pentesting](https://github.com/org-software-ciber-2627/software-ciber-2627/tree/main/modules/08-pentesting): `modules/08-pentesting`
### Event Management
- [Event Processing](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventService.java): `modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventService.java`
- [Event Repository](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/repositories/EventRepository.java): `modules/05-siem/src/main/java/com/ciberurjc/siem/repositories/EventRepository.java`
- [Alert Handling](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertService.java): `modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertService.java`
- [Alert Repository](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertRepository.java): `modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertRepository.java`
- [Alert Queries](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertQueryService.java): `modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertQueryService.java`
- [Event History](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventHistoryService.java): `modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventHistoryService.java`
- [History Endpoint](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/05-siem/src/main/java/com/ciberurjc/siem/controller/EventHistoryController.java): `modules/05-siem/src/main/java/com/ciberurjc/siem/controller/EventHistoryController.java`
### Incident Response
- [SOAR Incident Response](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/06-soar/src/app.py): `modules/06-soar/src/app.py`
- [Brute Force Playbook](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/06-soar/src/playbook-fuerza-bruta/entrada.py): `modules/06-soar/src/playbook-fuerza-bruta/entrada.py`
- [Incident Services](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/06-soar/src/soar/services/incident_service.py): `modules/06-soar/src/soar/services/incident_service.py`
- [Status History](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/06-soar/src/soar/services/status_service.py): `modules/06-soar/src/soar/services/status_service.py`
### Operator Interface
- [Dashboard](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/07-dashboard/src/SIEM-client.js): `modules/07-dashboard/src/SIEM-client.js`
- [Dashboard Authentication](https://github.com/org-software-ciber-2627/software-ciber-2627/blob/main/modules/07-dashboard/src/auth-client.js): `modules/07-dashboard/src/auth-client.js`
### Other components
- **Attacker**
- **SOC Operator**
- **SIEM Service**
## Connections
- Identity and Secrets → Secret Cryptography: uses (evidence: `modules/01-identidad/src/app.py`)
- IDS Runtime → Log Parsing: parses logs (evidence: `modules/02-ids/src/main.py`)
- IDS Runtime → IDS Rules: loads rules (evidence: `modules/02-ids/src/main.py`)
- IDS Runtime → Parsed Log Storage: saves parsed logs (evidence: `modules/02-ids/src/main.py`)
- Attacker → Web Honeypot: submits login (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java`)
- Web Honeypot → Attack Classifier: classifies attempt (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java`)
- Web Honeypot → Login Attempt Store: saves attempt (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java`)
- Web Honeypot → Event Mapper: maps event (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java`)
- Web Honeypot → SIEM Sender: sends event (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/controller/HoneyPotController.java`)
- FTP Event Capture → Attack Classifier: classifies attempt (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java`)
- FTP Event Capture → Login Attempt Store: saves attempt (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java`)
- FTP Event Capture → Event Mapper: maps event (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java`)
- FTP Event Capture → SIEM Sender: sends event (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/FtpEventService.java`)
- SIEM Sender → SIEM Service: HTTP POST (evidence: `modules/03-honeypot/src/main/java/com/honeypot/honeypot/service/SiemSenderService.java`)
- Event Processing → Event Repository: persists event (evidence: `modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventService.java`)
- Event Processing → Alert Repository: saves alert (evidence: `modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventService.java`)
- Event Processing → Alert Handling: emits alert (evidence: `modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventService.java`)
- Alert Queries → Alert Repository: queries alerts (evidence: `modules/05-siem/src/main/java/com/ciberurjc/siem/services/AlertQueryService.java`)
- History Endpoint → Event History: requests page (evidence: `modules/05-siem/src/main/java/com/ciberurjc/siem/controller/EventHistoryController.java`)
- Event History → Event Repository: reads events (evidence: `modules/05-siem/src/main/java/com/ciberurjc/siem/services/EventHistoryService.java`)
- Status History → SOAR Incident Response: supports workflow
- SOC Operator → Dashboard: uses