# raymondflores030104-lang/nexguard architecture

> Architecture diagram of the GitHub repository raymondflores030104-lang/nexguard, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/raymondflores030104-lang/nexguard
- Repository: https://github.com/raymondflores030104-lang/nexguard

## Overview

NEXGUARD is a Flask security-monitoring MVP: administrators configure environments and rules, environments send events, deterministic detection raises incidents, and analysts investigate and approve or reject responses. SQLite-backed core logic also provides authentication, audit verification, and response execution; the dashboard exposes monitoring and response status. The excerpts show key parts of ingestion, detection, AI investigation, and response handling, but omit several routes and the dashboard implementation, so those connections rely on README documentation or are left unspecified.

Main entry points: [`core.py`](https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py) (SQLite state), [`app.py`](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py) (API and web routes), [`dashboard.html`](https://github.com/raymondflores030104-lang/nexguard/blob/main/dashboard.html) (Monitoring dashboard)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_access["Access and configuration"]
  node_flask["API and web routes<br/>[app.py]"]
  node_env_mgmt["Environment management<br/>[app.py]"]
  node_auth["Authentication and permissions<br/>[app.py]"]
end

subgraph group_monitor["Monitoring and incidents"]
  node_rules["Detection rules<br/>[app.py]"]
  node_ingest["Event ingestion<br/>[app.py]"]
  node_detection["Deterministic detection<br/>[core.py]"]
  node_incidents["Incident management<br/>[app.py]"]
  node_dashboard["Monitoring dashboard<br/>[dashboard.html]"]
end

subgraph group_response["Investigation and response"]
  node_investigation["AI investigation<br/>[core.py]"]
  node_provider["AI provider adapter<br/>[core.py]"]
  node_approval["Human response approval<br/>[app.py]"]
  node_execution["Response execution<br/>[core.py]"]
  node_rollback["Response rollback<br/>[core.py]"]
end

subgraph group_platform["State and oversight"]
  node_storage[("SQLite state<br/>[core.py]")]
  node_audit["Audit chain<br/>[core.py]"]
  node_integrations["Integration status<br/>[app.py]"]
end

node_operator(("Security operator"))
node_environment(("Monitored environment"))
node_ai_service(("Optional AI service"))

node_operator -->|"uses API"| node_flask
node_environment -->|"sends events"| node_ingest
node_flask -->|"authenticates"| node_auth
node_operator -->|"manages environments"| node_env_mgmt
node_operator -->|"configures rules"| node_rules
node_ingest -->|"emits events"| node_detection
node_detection -->|"raises incidents"| node_incidents
node_operator -->|"reviews incidents"| node_incidents
node_incidents -->|"requests investigation"| node_investigation
node_investigation -->|"queries provider"| node_provider
node_provider -.->|"sends context"| node_ai_service
node_operator -->|"reviews responses"| node_approval
node_approval -->|"executes approval"| node_execution
node_approval -->|"requests rollback"| node_rollback
node_flask -->|"serves dashboard"| node_dashboard
node_operator -->|"views status"| node_integrations
node_flask -->|"reads and writes"| node_storage
node_detection -->|"reads and writes"| node_storage
node_investigation -->|"reads and writes"| node_storage
node_execution -->|"updates responses"| node_storage
node_rollback -->|"updates responses"| node_storage
node_flask -->|"records actions"| node_audit
node_execution -->|"records execution"| node_audit
node_audit -->|"stores hash chain"| node_storage

click node_flask "https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py"
click node_env_mgmt "https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py"
click node_auth "https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py"
click node_rules "https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py"
click node_ingest "https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py"
click node_detection "https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py"
click node_incidents "https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py"
click node_dashboard "https://github.com/raymondflores030104-lang/nexguard/blob/main/dashboard.html"
click node_investigation "https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py"
click node_provider "https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py"
click node_approval "https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py"
click node_execution "https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py"
click node_rollback "https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py"
click node_storage "https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py"
click node_audit "https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py"
click node_integrations "https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_flask,node_env_mgmt,node_auth toneBlue
class node_rules,node_ingest,node_detection,node_incidents,node_dashboard toneAmber
class node_investigation,node_provider,node_approval,node_execution,node_rollback toneMint
class node_storage,node_audit,node_integrations toneRose
class node_operator,node_environment,node_ai_service toneIndigo
```

## Components

### Access and configuration

- [API and web routes](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py): `app.py`
- [Environment management](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py): `app.py`
- [Authentication and permissions](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py): `app.py`

### Monitoring and incidents

- [Detection rules](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py): `app.py`
- [Event ingestion](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py): `app.py`
- [Deterministic detection](https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py): `core.py`
- [Incident management](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py): `app.py`
- [Monitoring dashboard](https://github.com/raymondflores030104-lang/nexguard/blob/main/dashboard.html): `dashboard.html`

### Investigation and response

- [AI investigation](https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py): `core.py`
- [AI provider adapter](https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py): `core.py`
- [Human response approval](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py): `app.py`
- [Response execution](https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py): `core.py`
- [Response rollback](https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py): `core.py`

### State and oversight

- [SQLite state](https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py): `core.py`
- [Audit chain](https://github.com/raymondflores030104-lang/nexguard/blob/main/core.py): `core.py`
- [Integration status](https://github.com/raymondflores030104-lang/nexguard/blob/main/app.py): `app.py`

### Other components

- **Security operator**
- **Monitored environment**
- **Optional AI service**

## Connections

- Security operator → API and web routes: uses API (evidence: `README.md`)
- Monitored environment → Event ingestion: sends events (evidence: `README.md`)
- API and web routes → Authentication and permissions: authenticates (evidence: `app.py`)
- Security operator → Environment management: manages environments (evidence: `README.md`)
- Security operator → Detection rules: configures rules (evidence: `README.md`)
- Event ingestion → Deterministic detection: emits events (evidence: `app.py`)
- Deterministic detection → Incident management: raises incidents (evidence: `core.py`)
- Security operator → Incident management: reviews incidents (evidence: `README.md`)
- Incident management → AI investigation: requests investigation (evidence: `README.md`)
- AI investigation → AI provider adapter: queries provider (evidence: `core.py`)
- AI provider adapter → Optional AI service: sends context (evidence: `core.py`)
- Security operator → Human response approval: reviews responses (evidence: `README.md`)
- Human response approval → Response execution: executes approval (evidence: `app.py`)
- Human response approval → Response rollback: requests rollback (evidence: `app.py`)
- API and web routes → Monitoring dashboard: serves dashboard (evidence: `README.md`)
- Security operator → Integration status: views status (evidence: `README.md`)
- API and web routes → SQLite state: reads and writes (evidence: `app.py`)
- Deterministic detection → SQLite state: reads and writes (evidence: `core.py`)
- AI investigation → SQLite state: reads and writes (evidence: `core.py`)
- Response execution → SQLite state: updates responses (evidence: `core.py`)
- Response rollback → SQLite state: updates responses (evidence: `core.py`)
- API and web routes → Audit chain: records actions (evidence: `app.py`)
- Response execution → Audit chain: records execution (evidence: `core.py`)
- Audit chain → SQLite state: stores hash chain (evidence: `core.py`)