# rishikarjula/cyberops-soc-ai architecture

> Architecture diagram of the GitHub repository rishikarjula/cyberops-soc-ai, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rishikarjula/cyberops-soc-ai
- Repository: https://github.com/rishikarjula/cyberops-soc-ai

## Overview

CyberOps SOC is a role-based security operations platform for alert triage, investigation, detection engineering, remediation coordination, knowledge exploration, and platform administration. Users enter through the application shell and workspaces; operational records are served through a repository layer that can select Supabase-backed or local demo adapters. The source index documents these capabilities, but most feature components and repository implementations were not excerpted, so only clearly evidenced calls and documented repository wiring are shown.

Main entry points: [`src/repositories/index.ts`](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/index.ts) (Repository registry), [`src/App.tsx`](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/App.tsx) (Application shell), [`src/services/knowledgeService.ts`](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/knowledgeService.ts) (Knowledge services), [`src/components/security-engineer/SecurityEngineerDashboard.tsx`](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/security-engineer/SecurityEngineerDashboard.tsx) (Detection engineering)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Application entry"]
  node_app["Application shell<br/>[App.tsx]"]
  node_auth["Authentication context<br/>[AuthContext.tsx]"]
end

subgraph group_operations["SOC operations"]
  node_analyst["Alert triage &amp; investigation"]
  node_audit["Audit &amp; incident tasks<br/>[AuditLogViewer.tsx]"]
  node_itops["IT remediation workspace"]
  node_soc_knowledge["SOC knowledge hub"]
end

subgraph group_engineering["Security engineering"]
  node_engineer["Detection engineering"]
  node_recommendations["Detection recommendations"]
  node_eng_overview["Engineering knowledge overview"]
  node_it_knowledge["IT operations knowledge<br/>[ItOpsWorkspace.tsx]"]
end

subgraph group_platform["Platform services"]
  node_admin["Platform administration"]
  node_copilot["AI copilot API<br/>[copilotRouter.ts]"]
  node_knowledge["Knowledge services"]
  node_detection["Detection rule services"]
  node_triage["Deterministic triage"]
  node_authorization["Authorization service"]
end

subgraph group_storage["Data access"]
  node_repo_factory["Repository registry<br/>[index.ts]"]
  node_supabase["Supabase client<br/>[supabaseClient.ts]"]
  node_local_alerts["Local alert repository"]
  node_local_audit["Local audit repository"]
  node_local_mitre["Local MITRE repository"]
  node_local_recommendations["Local recommendation repository"]
  node_supabase_alerts["Supabase alert repository"]
  node_supabase_audit["Supabase audit repository"]
  node_supabase_recommendations["Supabase recommendation repository"]
end

node_user(("Role-based user"))

node_user -->|"uses"| node_app
node_app -->|"wraps"| node_auth
node_app -->|"loads repositories"| node_repo_factory
node_app -->|"renders admin view"| node_admin
node_app -->|"fetches SOC knowledge"| node_knowledge
node_engineer -->|"uses rules"| node_detection
node_engineer -->|"renders"| node_recommendations
node_engineer -->|"loads engineering data"| node_knowledge
node_eng_overview -->|"fetches knowledge"| node_knowledge
node_repo_factory -->|"checks configuration"| node_supabase
node_repo_factory -->|"selects adapter"| node_local_alerts
node_repo_factory -->|"selects adapter"| node_local_audit
node_repo_factory -->|"selects adapter"| node_local_mitre
node_repo_factory -->|"selects adapter"| node_local_recommendations
node_repo_factory -->|"selects adapter"| node_supabase_alerts
node_repo_factory -->|"selects adapter"| node_supabase_audit
node_repo_factory -->|"selects adapter"| node_supabase_recommendations
node_local_audit -->|"checks permissions"| node_authorization
node_local_audit -.->|"stores task records"| node_audit
node_copilot -->|"assembles context"| node_knowledge

click node_app "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/App.tsx"
click node_auth "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/context/AuthContext.tsx"
click node_analyst "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/analyst/AlertTriageDashboard.tsx"
click node_audit "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/audit/AuditLogViewer.tsx"
click node_itops "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/it-operations/ITOperationsDashboard.tsx"
click node_soc_knowledge "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/analyst/knowledge/SocKnowledgeHub.tsx"
click node_engineer "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/security-engineer/SecurityEngineerDashboard.tsx"
click node_recommendations "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/security-engineer/ImprovementRecommendationsView.tsx"
click node_eng_overview "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/security-engineer/SecurityEngineerOverviewPage.tsx"
click node_it_knowledge "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/it-operations/knowledge/ItOpsWorkspace.tsx"
click node_admin "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/admin/PlatformAdminDashboard.tsx"
click node_copilot "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/server/ai/copilotRouter.ts"
click node_knowledge "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/knowledgeService.ts"
click node_detection "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/detectionRuleService.ts"
click node_triage "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/deterministicTriageService.ts"
click node_authorization "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/authorizationService.ts"
click node_repo_factory "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/index.ts"
click node_supabase "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/lib/supabaseClient.ts"
click node_local_alerts "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/local/LocalAlertRepository.ts"
click node_local_audit "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/local/LocalAuditLogRepository.ts"
click node_local_mitre "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/local/LocalMITRERepository.ts"
click node_local_recommendations "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/local/LocalDetectionRecommendationRepository.ts"
click node_supabase_alerts "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/supabase/SupabaseAlertRepository.ts"
click node_supabase_audit "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/supabase/SupabaseAuditLogRepository.ts"
click node_supabase_recommendations "https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/supabase/SupabaseDetectionRecommendationRepository.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_auth,node_user toneBlue
class node_analyst,node_audit,node_itops,node_soc_knowledge toneAmber
class node_engineer,node_recommendations,node_eng_overview,node_it_knowledge toneMint
class node_admin,node_copilot,node_knowledge,node_detection,node_triage,node_authorization toneRose
class node_repo_factory,node_supabase,node_local_alerts,node_local_audit,node_local_mitre,node_local_recommendations,node_supabase_alerts,node_supabase_audit,node_supabase_recommendations toneIndigo
```

## Components

### Application entry

- [Application shell](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/App.tsx): `src/App.tsx`
- [Authentication context](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/context/AuthContext.tsx): `src/context/AuthContext.tsx`

### SOC operations

- [Alert triage & investigation](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/analyst/AlertTriageDashboard.tsx): `src/components/analyst/AlertTriageDashboard.tsx`
- [Audit & incident tasks](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/audit/AuditLogViewer.tsx): `src/components/audit/AuditLogViewer.tsx`
- [IT remediation workspace](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/it-operations/ITOperationsDashboard.tsx): `src/components/it-operations/ITOperationsDashboard.tsx`
- [SOC knowledge hub](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/analyst/knowledge/SocKnowledgeHub.tsx): `src/components/analyst/knowledge/SocKnowledgeHub.tsx`

### Security engineering

- [Detection engineering](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/security-engineer/SecurityEngineerDashboard.tsx): `src/components/security-engineer/SecurityEngineerDashboard.tsx`
- [Detection recommendations](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/security-engineer/ImprovementRecommendationsView.tsx): `src/components/security-engineer/ImprovementRecommendationsView.tsx`
- [Engineering knowledge overview](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/security-engineer/SecurityEngineerOverviewPage.tsx): `src/components/security-engineer/SecurityEngineerOverviewPage.tsx`
- [IT operations knowledge](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/it-operations/knowledge/ItOpsWorkspace.tsx): `src/components/it-operations/knowledge/ItOpsWorkspace.tsx`

### Platform services

- [Platform administration](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/components/admin/PlatformAdminDashboard.tsx): `src/components/admin/PlatformAdminDashboard.tsx`
- [AI copilot API](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/server/ai/copilotRouter.ts): `src/server/ai/copilotRouter.ts`
- [Knowledge services](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/knowledgeService.ts): `src/services/knowledgeService.ts`
- [Detection rule services](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/detectionRuleService.ts): `src/services/detectionRuleService.ts`
- [Deterministic triage](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/deterministicTriageService.ts): `src/services/deterministicTriageService.ts`
- [Authorization service](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/services/authorizationService.ts): `src/services/authorizationService.ts`

### Data access

- [Repository registry](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/index.ts): `src/repositories/index.ts`
- [Supabase client](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/lib/supabaseClient.ts): `src/lib/supabaseClient.ts`
- [Local alert repository](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/local/LocalAlertRepository.ts): `src/repositories/local/LocalAlertRepository.ts`
- [Local audit repository](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/local/LocalAuditLogRepository.ts): `src/repositories/local/LocalAuditLogRepository.ts`
- [Local MITRE repository](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/local/LocalMITRERepository.ts): `src/repositories/local/LocalMITRERepository.ts`
- [Local recommendation repository](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/local/LocalDetectionRecommendationRepository.ts): `src/repositories/local/LocalDetectionRecommendationRepository.ts`
- [Supabase alert repository](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/supabase/SupabaseAlertRepository.ts): `src/repositories/supabase/SupabaseAlertRepository.ts`
- [Supabase audit repository](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/supabase/SupabaseAuditLogRepository.ts): `src/repositories/supabase/SupabaseAuditLogRepository.ts`
- [Supabase recommendation repository](https://github.com/rishikarjula/cyberops-soc-ai/blob/main/src/repositories/supabase/SupabaseDetectionRecommendationRepository.ts): `src/repositories/supabase/SupabaseDetectionRecommendationRepository.ts`

### Other components

- **Role-based user**

## Connections

- Role-based user → Application shell: uses (evidence: `src/App.tsx`)
- Application shell → Authentication context: wraps (evidence: `src/App.tsx`)
- Application shell → Repository registry: loads repositories (evidence: `src/App.tsx`)
- Application shell → Platform administration: renders admin view (evidence: `src/App.tsx`)
- Application shell → Knowledge services: fetches SOC knowledge (evidence: `src/App.tsx`)
- Detection engineering → Detection rule services: uses rules (evidence: `src/components/security-engineer/SecurityEngineerDashboard.tsx`)
- Detection engineering → Detection recommendations: renders (evidence: `src/components/security-engineer/SecurityEngineerDashboard.tsx`)
- Detection engineering → Knowledge services: loads engineering data (evidence: `src/components/security-engineer/SecurityEngineerDashboard.tsx`)
- Engineering knowledge overview → Knowledge services: fetches knowledge (evidence: `src/components/security-engineer/SecurityEngineerOverviewPage.tsx`)
- Repository registry → Supabase client: checks configuration (evidence: `src/repositories/index.ts`)
- Repository registry → Local alert repository: selects adapter (evidence: `src/repositories/index.ts`)
- Repository registry → Local audit repository: selects adapter (evidence: `src/repositories/index.ts`)
- Repository registry → Local MITRE repository: selects adapter (evidence: `src/repositories/index.ts`)
- Repository registry → Local recommendation repository: selects adapter (evidence: `src/repositories/index.ts`)
- Repository registry → Supabase alert repository: selects adapter (evidence: `src/repositories/index.ts`)
- Repository registry → Supabase audit repository: selects adapter (evidence: `src/repositories/index.ts`)
- Repository registry → Supabase recommendation repository: selects adapter (evidence: `src/repositories/index.ts`)
- Local audit repository → Authorization service: checks permissions (evidence: `src/repositories/local/LocalAuditLogRepository.ts`)
- Local audit repository → Audit & incident tasks: stores task records
- AI copilot API → Knowledge services: assembles context (evidence: `src/server/ai/copilotRouter.ts`)