# riyaparekh7/intrusense architecture

> Architecture diagram of the GitHub repository riyaparekh7/intrusense, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/riyaparekh7/intrusense
- Repository: https://github.com/riyaparekh7/intrusense

## Overview

IntruSense is a Flask insider-threat monitoring application. Users sign in, activity logs are generated or retrieved, risk is assessed, and user or admin dashboards present scores, alerts, and aggregate trends; the browser can also submit activity for manual analysis. The backend uses SQLite for logs and an Isolation Forest alongside score-based severity rules. Dashboard templates and styling are represented as product surfaces. The sampled source shows the main backend, storage, and chart interactions; other template behavior is summarized from the README and file tree.

Main entry points: [`app.py`](https://github.com/riyaparekh7/intrusense/blob/main/app.py) (Login and routing), [`database.py`](https://github.com/riyaparekh7/intrusense/blob/main/database.py) (SQLite log store), [`static/script.js`](https://github.com/riyaparekh7/intrusense/blob/main/static/script.js) (Manual analysis UI), [`templates/user_dashboard.html`](https://github.com/riyaparekh7/intrusense/blob/main/templates/user_dashboard.html) (User dashboard)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Web experience"]
  node_auth["Login and routing<br/>[app.py]"]
  node_manual_ui["Manual analysis UI<br/>[script.js]"]
  node_landing["Landing page<br/>[index.html]"]
  node_login_view["Login page<br/>[login.html]"]
end

subgraph group_risk["Risk analysis"]
  node_manual_api["Manual analysis endpoint<br/>[app.py]"]
  node_detector["Anomaly detector<br/>[app.py]"]
  node_severity["Score and severity<br/>[app.py]"]
  node_activity["Activity log generation<br/>[app.py]"]
end

subgraph group_storage["Activity storage"]
  node_database[("SQLite log store<br/>[database.py]")]
end

subgraph group_views["Dashboards"]
  node_user_view["User dashboard"]
  node_admin_view["Admin dashboard"]
  node_alerts["User alerts<br/>[app.py]"]
  node_stats["Statistics endpoint<br/>[app.py]"]
  node_charts["Risk charts<br/>[script.js]"]
end

node_user(("User"))
node_admin(("Administrator"))

node_user -->|"signs in"| node_auth
node_admin -->|"signs in"| node_auth
node_auth -->|"renders"| node_login_view
node_auth -->|"renders"| node_landing
node_auth -->|"creates logs"| node_activity
node_activity -->|"inserts logs"| node_database
node_database -->|"returns logs"| node_auth
node_auth -->|"renders"| node_user_view
node_auth -->|"renders"| node_admin_view
node_auth -->|"builds alerts"| node_alerts
node_alerts -->|"provides alerts"| node_user_view
node_auth -->|"serves stats"| node_stats
node_stats -->|"fetches logs"| node_database
node_charts -->|"fetches data"| node_stats
node_user -->|"enters activity"| node_manual_ui
node_manual_ui -->|"posts features"| node_manual_api
node_manual_api -->|"analyzes features"| node_detector
node_manual_api -->|"calculates score"| node_severity

click node_auth "https://github.com/riyaparekh7/intrusense/blob/main/app.py"
click node_manual_ui "https://github.com/riyaparekh7/intrusense/blob/main/static/script.js"
click node_manual_api "https://github.com/riyaparekh7/intrusense/blob/main/app.py"
click node_detector "https://github.com/riyaparekh7/intrusense/blob/main/app.py"
click node_severity "https://github.com/riyaparekh7/intrusense/blob/main/app.py"
click node_activity "https://github.com/riyaparekh7/intrusense/blob/main/app.py"
click node_database "https://github.com/riyaparekh7/intrusense/blob/main/database.py"
click node_user_view "https://github.com/riyaparekh7/intrusense/blob/main/templates/user_dashboard.html"
click node_admin_view "https://github.com/riyaparekh7/intrusense/blob/main/templates/admin_dashboard.html"
click node_alerts "https://github.com/riyaparekh7/intrusense/blob/main/app.py"
click node_stats "https://github.com/riyaparekh7/intrusense/blob/main/app.py"
click node_charts "https://github.com/riyaparekh7/intrusense/blob/main/static/script.js"
click node_landing "https://github.com/riyaparekh7/intrusense/blob/main/templates/index.html"
click node_login_view "https://github.com/riyaparekh7/intrusense/blob/main/templates/login.html"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_auth,node_manual_ui,node_landing,node_login_view,node_user toneBlue
class node_manual_api,node_detector,node_severity,node_activity toneAmber
class node_database toneMint
class node_user_view,node_admin_view,node_alerts,node_stats,node_charts toneRose
class node_admin toneIndigo
```

## Components

### Web experience

- [Login and routing](https://github.com/riyaparekh7/intrusense/blob/main/app.py): `app.py`
- [Manual analysis UI](https://github.com/riyaparekh7/intrusense/blob/main/static/script.js): `static/script.js`
- [Landing page](https://github.com/riyaparekh7/intrusense/blob/main/templates/index.html): `templates/index.html`
- [Login page](https://github.com/riyaparekh7/intrusense/blob/main/templates/login.html): `templates/login.html`

### Risk analysis

- [Manual analysis endpoint](https://github.com/riyaparekh7/intrusense/blob/main/app.py): `app.py`
- [Anomaly detector](https://github.com/riyaparekh7/intrusense/blob/main/app.py): `app.py`
- [Score and severity](https://github.com/riyaparekh7/intrusense/blob/main/app.py): `app.py`
- [Activity log generation](https://github.com/riyaparekh7/intrusense/blob/main/app.py): `app.py`

### Activity storage

- [SQLite log store](https://github.com/riyaparekh7/intrusense/blob/main/database.py): `database.py`

### Dashboards

- [User dashboard](https://github.com/riyaparekh7/intrusense/blob/main/templates/user_dashboard.html): `templates/user_dashboard.html`
- [Admin dashboard](https://github.com/riyaparekh7/intrusense/blob/main/templates/admin_dashboard.html): `templates/admin_dashboard.html`
- [User alerts](https://github.com/riyaparekh7/intrusense/blob/main/app.py): `app.py`
- [Statistics endpoint](https://github.com/riyaparekh7/intrusense/blob/main/app.py): `app.py`
- [Risk charts](https://github.com/riyaparekh7/intrusense/blob/main/static/script.js): `static/script.js`

### Other components

- **User**
- **Administrator**

## Connections

- User → Login and routing: signs in (evidence: `app.py`)
- Administrator → Login and routing: signs in (evidence: `app.py`)
- Login and routing → Login page: renders (evidence: `app.py`)
- Login and routing → Landing page: renders (evidence: `app.py`)
- Login and routing → Activity log generation: creates logs (evidence: `app.py`)
- Activity log generation → SQLite log store: inserts logs (evidence: `app.py`)
- SQLite log store → Login and routing: returns logs (evidence: `app.py`)
- Login and routing → User dashboard: renders (evidence: `app.py`)
- Login and routing → Admin dashboard: renders (evidence: `app.py`)
- Login and routing → User alerts: builds alerts (evidence: `app.py`)
- User alerts → User dashboard: provides alerts (evidence: `app.py`)
- Login and routing → Statistics endpoint: serves stats (evidence: `app.py`)
- Statistics endpoint → SQLite log store: fetches logs (evidence: `app.py`)
- Risk charts → Statistics endpoint: fetches data (evidence: `static/script.js`)
- User → Manual analysis UI: enters activity (evidence: `static/script.js`)
- Manual analysis UI → Manual analysis endpoint: posts features (evidence: `static/script.js`)
- Manual analysis endpoint → Anomaly detector: analyzes features (evidence: `app.py`)
- Manual analysis endpoint → Score and severity: calculates score (evidence: `app.py`)