How preethamacharya86/counterpulse works
CounterPulse is an evidence-first cyber-fraud incident intake and case-management application. A user creates or selects an incident case, submits files, text, chats, or suspicious URLs, and the backend validates and stores evidence before normalizing it for review. The visible interface exposes case selection and evidence intake; the domain models and output schemas also represent incident reconstruction, indicators, compromise assessments, timelines, and response packages. Those latter capabilities are represented as data structures, not as an asserted processing pipeline: the supplied excerpts do not show their runtime orchestration.
Main entry points: evidence_service.py Evidence Service · case.py Case Record · evidence.py Evidence Endpoints · App.tsx Case Dashboard
Components 22
Casework UI
- Case Dashboard
frontend/src/App.tsx - Evidence Uploader
frontend/src/components/EvidenceUploader.tsx
HTTP API
- Case Endpoints
backend/app/api/v1/cases.py - Evidence Endpoints
backend/app/api/v1/evidence.py - API Router
backend/app/api/router.py
Evidence Intake
- Evidence Service
backend/app/services/evidence_service.py - Upload Safety
backend/app/core/security.py
Normalization
- Processor Factory
backend/app/services/evidence/factory.py - Normalized Evidence
backend/app/services/evidence/base.py - Chat Processor
backend/app/services/evidence/chat_processor.py - Other Processors
backend/app/services/evidence - Live Chat Processor
backend/app/services/evidence/live_processor.py
Incident Records
- Case Record
backend/app/models/case.py - Evidence Record
backend/app/models/evidence.py - Analysis Records
backend/app/models/indicator.py - Timeline Record
backend/app/models/timeline.py - Compromise Record
backend/app/models/compromise.py - Report Record
backend/app/models/report.py - Analysis Schemas
backend/app/schemas/ai_output.py - SQL Database
backend/app/core/database.py - Evidence Files
Other components
- Investigator
Connections 24
- Investigator → Case Dashboard: uses
- Case Dashboard → Case Endpoints: requests cases
- Case Dashboard → Evidence Uploader: selects evidence
- Evidence Uploader → Evidence Endpoints: submits evidence
- API Router → Case Endpoints: dispatches
- API Router → Evidence Endpoints: dispatches
- Evidence Endpoints → Evidence Service: ingests and processes
- Case Endpoints → SQL Database: queries cases
- Evidence Endpoints → SQL Database: queries records
- Evidence Service → Upload Safety: validates uploads
- Evidence Service → Processor Factory: selects processor
- Evidence Service → Live Chat Processor: processes live chunks
- Evidence Service → SQL Database: reads and writes
- Evidence Service → Evidence Files: stores uploads
- Processor Factory → Chat Processor: creates processor
- Processor Factory → Other Processors: creates processor
- Chat Processor → Normalized Evidence: returns normalized data
- Other Processors → Normalized Evidence: returns normalized data
- Live Chat Processor → Normalized Evidence: returns normalized data
- Case Record → Evidence Record: associates evidence
- Case Record → Analysis Records: relates indicators
- Case Record → Timeline Record: relates events
- Case Record → Compromise Record: relates assessments
- Case Record → Report Record: relates reports