How raymondflores030104-lang/nexguard works
NEXGUARD is a Flask security-monitoring MVP: administrators configure environments and rules, environments send events, deterministic detection raises incidents, and analysts investigate and approve or reject responses. SQLite-backed core logic also provides authentication, audit verification, and response execution; the dashboard exposes monitoring and response status. The excerpts show key parts of ingestion, detection, AI investigation, and response handling, but omit several routes and the dashboard implementation, so those connections rely on README documentation or are left unspecified.
Main entry points: core.py SQLite state · app.py API and web routes · dashboard.html Monitoring dashboard
Components 19
Access and configuration
- API and web routes
app.py - Environment management
app.py - Authentication and permissions
app.py
Monitoring and incidents
- Detection rules
app.py - Event ingestion
app.py - Deterministic detection
core.py - Incident management
app.py - Monitoring dashboard
dashboard.html
Investigation and response
- AI investigation
core.py - AI provider adapter
core.py - Human response approval
app.py - Response execution
core.py - Response rollback
core.py
State and oversight
- SQLite state
core.py - Audit chain
core.py - Integration status
app.py
Other components
- Security operator
- Monitored environment
- Optional AI service
Connections 24
- Security operator → API and web routes: uses API
README.md - Monitored environment → Event ingestion: sends events
README.md - API and web routes → Authentication and permissions: authenticates
app.py - Security operator → Environment management: manages environments
README.md - Security operator → Detection rules: configures rules
README.md - Event ingestion → Deterministic detection: emits events
app.py - Deterministic detection → Incident management: raises incidents
core.py - Security operator → Incident management: reviews incidents
README.md - Incident management → AI investigation: requests investigation
README.md - AI investigation → AI provider adapter: queries provider
core.py - AI provider adapter → Optional AI service: sends context
core.py - Security operator → Human response approval: reviews responses
README.md - Human response approval → Response execution: executes approval
app.py - Human response approval → Response rollback: requests rollback
app.py - API and web routes → Monitoring dashboard: serves dashboard
README.md - Security operator → Integration status: views status
README.md - API and web routes → SQLite state: reads and writes
app.py - Deterministic detection → SQLite state: reads and writes
core.py - AI investigation → SQLite state: reads and writes
core.py - Response execution → SQLite state: updates responses
core.py - Response rollback → SQLite state: updates responses
core.py - API and web routes → Audit chain: records actions
app.py - Response execution → Audit chain: records execution
core.py - Audit chain → SQLite state: stores hash chain
core.py