# rabobank-cdc/dettect architecture

> Architecture diagram of the GitHub repository rabobank-cdc/dettect, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rabobank-cdc/dettect
- Repository: https://github.com/rabobank-cdc/dettect

## Overview

DeTT&CT supports blue teams mapping ATT&CK data sources, visibility, detections, and threat-actor behavior. Users administer scores and mappings in YAML through the Editor or CLI; the CLI analyzes those files and produces Navigator layers, reports, and exports. The graph preserves the documented scoring and comparison capabilities, while source excerpts chiefly establish CLI orchestration and selected Editor interactions; some capability links are therefore documented rather than implementation-traced.

Main entry points: [`dettect.py`](https://github.com/rabobank-cdc/dettect/blob/master/dettect.py) (CLI commands), [`generic.py`](https://github.com/rabobank-cdc/dettect/blob/master/generic.py) (Shared ATT&CK utilities), [`group_mapping.py`](https://github.com/rabobank-cdc/dettect/blob/master/group_mapping.py) (Group behavior mapping), [`data_source_mapping.py`](https://github.com/rabobank-cdc/dettect/blob/master/data_source_mapping.py) (Data source mapping)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_editor["YAML Editor"]
  node_editor_app["Editor application<br/>[main.js]"]
  node_yaml_pages["YAML editing pages"]
  node_page_helpers["Page editing helpers<br/>[PageMixins.js]"]
  node_editor_notices["Editor notifications"]
end

subgraph group_cli["CLI workflows"]
  node_cli_entry["CLI commands<br/>[dettect.py]"]
  node_generic_workflows["Generic workflows<br/>[generic_mode.py]"]
  node_yaml_upgrade["YAML upgrade<br/>[upgrade.py]"]
end

subgraph group_attack["ATT&amp;CK data"]
  node_taxii["ATT&amp;CK TAXII client"]
  node_shared_data["Shared ATT&amp;CK utilities<br/>[generic.py]"]
end

subgraph group_analysis["Mapping and scoring"]
  node_data_source["Data source mapping"]
  node_technique["Technique mapping"]
  node_group_mapping["Group behavior mapping<br/>[group_mapping.py]"]
  node_eql_search["Technique search<br/>[eql_yaml.py]"]
  node_health["Coverage comparison<br/>[health.py]"]
end

subgraph group_output["Visualizations and exports"]
  node_navigator["Navigator layer generation<br/>[navigator_layer.py]"]
  node_file_output["File and export output<br/>[file_output.py]"]
end

node_user(("Blue team user"))
node_external_attack[("ATT&amp;CK STIX data")]
node_navigator_service(("ATT&amp;CK Navigator"))

node_user -->|"edits YAML"| node_editor_app
node_editor_app -->|"routes to"| node_yaml_pages
node_yaml_pages -->|"uses"| node_page_helpers
node_yaml_pages -->|"notifies through"| node_editor_notices
node_user -->|"runs commands"| node_cli_entry
node_cli_entry -->|"dispatches"| node_data_source
node_cli_entry -->|"dispatches"| node_technique
node_cli_entry -->|"dispatches"| node_group_mapping
node_cli_entry -->|"dispatches"| node_eql_search
node_cli_entry -->|"dispatches"| node_generic_workflows
node_cli_entry -->|"dispatches"| node_yaml_upgrade
node_generic_workflows -->|"uses"| node_shared_data
node_shared_data -->|"loads ATT&amp;CK data"| node_taxii
node_external_attack -.->|"provides STIX data"| node_taxii
node_data_source -->|"uses"| node_shared_data
node_data_source -->|"builds layers"| node_navigator
node_data_source -->|"exports files"| node_file_output
node_technique -->|"uses"| node_shared_data
node_technique -->|"builds layers"| node_navigator
node_technique -->|"exports files"| node_file_output
node_group_mapping -->|"searches techniques"| node_eql_search
node_group_mapping -->|"uses"| node_shared_data
node_group_mapping -->|"builds overlays"| node_navigator
node_group_mapping -->|"writes output"| node_file_output
node_eql_search -->|"uses"| node_shared_data
node_health -.->|"uses"| node_shared_data
node_yaml_upgrade -->|"uses"| node_shared_data
node_yaml_upgrade -->|"writes backups"| node_file_output
node_navigator -->|"layers for"| node_navigator_service

click node_editor_app "https://github.com/rabobank-cdc/dettect/blob/master/editor/src/main.js"
click node_yaml_pages "https://github.com/rabobank-cdc/dettect/tree/master/editor/src/pages"
click node_page_helpers "https://github.com/rabobank-cdc/dettect/blob/master/editor/src/mixins/PageMixins.js"
click node_editor_notices "https://github.com/rabobank-cdc/dettect/blob/master/editor/src/mixins/NotificationMixins.js"
click node_cli_entry "https://github.com/rabobank-cdc/dettect/blob/master/dettect.py"
click node_generic_workflows "https://github.com/rabobank-cdc/dettect/blob/master/generic_mode.py"
click node_yaml_upgrade "https://github.com/rabobank-cdc/dettect/blob/master/upgrade.py"
click node_taxii "https://github.com/rabobank-cdc/dettect/blob/master/attack_taxii_client.py"
click node_shared_data "https://github.com/rabobank-cdc/dettect/blob/master/generic.py"
click node_data_source "https://github.com/rabobank-cdc/dettect/blob/master/data_source_mapping.py"
click node_technique "https://github.com/rabobank-cdc/dettect/blob/master/technique_mapping.py"
click node_group_mapping "https://github.com/rabobank-cdc/dettect/blob/master/group_mapping.py"
click node_eql_search "https://github.com/rabobank-cdc/dettect/blob/master/eql_yaml.py"
click node_health "https://github.com/rabobank-cdc/dettect/blob/master/health.py"
click node_navigator "https://github.com/rabobank-cdc/dettect/blob/master/navigator_layer.py"
click node_file_output "https://github.com/rabobank-cdc/dettect/blob/master/file_output.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_editor_app,node_yaml_pages,node_page_helpers,node_editor_notices,node_user toneBlue
class node_cli_entry,node_generic_workflows,node_yaml_upgrade,node_external_attack toneAmber
class node_taxii,node_shared_data toneMint
class node_data_source,node_technique,node_group_mapping,node_eql_search,node_health toneRose
class node_navigator,node_file_output,node_navigator_service toneIndigo
```

## Components

### YAML Editor

- [Editor application](https://github.com/rabobank-cdc/dettect/blob/master/editor/src/main.js): `editor/src/main.js`
- [YAML editing pages](https://github.com/rabobank-cdc/dettect/tree/master/editor/src/pages): `editor/src/pages`
- [Page editing helpers](https://github.com/rabobank-cdc/dettect/blob/master/editor/src/mixins/PageMixins.js): `editor/src/mixins/PageMixins.js`
- [Editor notifications](https://github.com/rabobank-cdc/dettect/blob/master/editor/src/mixins/NotificationMixins.js): `editor/src/mixins/NotificationMixins.js`

### CLI workflows

- [CLI commands](https://github.com/rabobank-cdc/dettect/blob/master/dettect.py): `dettect.py`
- [Generic workflows](https://github.com/rabobank-cdc/dettect/blob/master/generic_mode.py): `generic_mode.py`
- [YAML upgrade](https://github.com/rabobank-cdc/dettect/blob/master/upgrade.py): `upgrade.py`

### ATT&CK data

- [ATT&CK TAXII client](https://github.com/rabobank-cdc/dettect/blob/master/attack_taxii_client.py): `attack_taxii_client.py`
- [Shared ATT&CK utilities](https://github.com/rabobank-cdc/dettect/blob/master/generic.py): `generic.py`

### Mapping and scoring

- [Data source mapping](https://github.com/rabobank-cdc/dettect/blob/master/data_source_mapping.py): `data_source_mapping.py`
- [Technique mapping](https://github.com/rabobank-cdc/dettect/blob/master/technique_mapping.py): `technique_mapping.py`
- [Group behavior mapping](https://github.com/rabobank-cdc/dettect/blob/master/group_mapping.py): `group_mapping.py`
- [Technique search](https://github.com/rabobank-cdc/dettect/blob/master/eql_yaml.py): `eql_yaml.py`
- [Coverage comparison](https://github.com/rabobank-cdc/dettect/blob/master/health.py): `health.py`

### Visualizations and exports

- [Navigator layer generation](https://github.com/rabobank-cdc/dettect/blob/master/navigator_layer.py): `navigator_layer.py`
- [File and export output](https://github.com/rabobank-cdc/dettect/blob/master/file_output.py): `file_output.py`

### Other components

- **Blue team user**
- **ATT&CK STIX data**
- **ATT&CK Navigator**

## Connections

- Blue team user → Editor application: edits YAML
- Editor application → YAML editing pages: routes to
- YAML editing pages → Page editing helpers: uses (evidence: `editor/src/pages/DataSourcesPage.vue`)
- YAML editing pages → Editor notifications: notifies through (evidence: `editor/src/pages/TechniquesPage.vue`)
- Blue team user → CLI commands: runs commands
- CLI commands → Data source mapping: dispatches (evidence: `dettect.py`)
- CLI commands → Technique mapping: dispatches (evidence: `dettect.py`)
- CLI commands → Group behavior mapping: dispatches (evidence: `dettect.py`)
- CLI commands → Technique search: dispatches (evidence: `dettect.py`)
- CLI commands → Generic workflows: dispatches (evidence: `dettect.py`)
- CLI commands → YAML upgrade: dispatches (evidence: `dettect.py`)
- Generic workflows → Shared ATT&CK utilities: uses (evidence: `generic_mode.py`)
- Shared ATT&CK utilities → ATT&CK TAXII client: loads ATT&CK data (evidence: `generic.py`)
- ATT&CK STIX data → ATT&CK TAXII client: provides STIX data
- Data source mapping → Shared ATT&CK utilities: uses (evidence: `data_source_mapping.py`)
- Data source mapping → Navigator layer generation: builds layers (evidence: `data_source_mapping.py`)
- Data source mapping → File and export output: exports files (evidence: `data_source_mapping.py`)
- Technique mapping → Shared ATT&CK utilities: uses (evidence: `technique_mapping.py`)
- Technique mapping → Navigator layer generation: builds layers (evidence: `technique_mapping.py`)
- Technique mapping → File and export output: exports files (evidence: `technique_mapping.py`)
- Group behavior mapping → Technique search: searches techniques (evidence: `group_mapping.py`)
- Group behavior mapping → Shared ATT&CK utilities: uses (evidence: `group_mapping.py`)
- Group behavior mapping → Navigator layer generation: builds overlays (evidence: `group_mapping.py`)
- Group behavior mapping → File and export output: writes output (evidence: `group_mapping.py`)
- Technique search → Shared ATT&CK utilities: uses (evidence: `eql_yaml.py`)
- Coverage comparison → Shared ATT&CK utilities: uses (evidence: `generic.py`)
- YAML upgrade → Shared ATT&CK utilities: uses (evidence: `upgrade.py`)
- YAML upgrade → File and export output: writes backups (evidence: `upgrade.py`)
- Navigator layer generation → ATT&CK Navigator: layers for