How salaheddine-hadraoui/kestro works
Kestro is a SOC operations and investigation platform: analysts triage a shared alert queue, create and work cases, attach evidence and hypotheses, and resolve cases with an auditable record. Leads also manage users, playbooks, and organization-wide knowledge. The graph reflects the modular Next.js/NestJS application in the tree, while the README describes the intended product workflow. Several service implementations and UI action paths were not excerpted, so their internal links are omitted; the web-to-API boundary is supported by the API client excerpt.
Main entry points: app.module.ts Nest application · cases.controller.ts Case workflow · api-client.ts Authenticated API client · auth.controller.ts JWT authentication
Components 19
Web workspace
- Workspace UI
apps/web/app/(workspace) - Web feature services
apps/web/features - Authenticated API client
apps/web/lib/server/api-client.ts - Web auth
apps/web/features/auth/service.ts
API workflows
- Alert queue
apps/api/src/alerts/alerts.controller.ts - Case workflow
apps/api/src/cases/cases.controller.ts - Evidence files
apps/api/src/evidence/evidence.controller.ts - Hypotheses
apps/api/src/investigations/investigations.controller.ts - Case timeline
apps/api/src/timeline/timeline.controller.ts - Case knowledge links
apps/api/src/case-knowledge/case-knowledge.controller.ts - Knowledge library
apps/api/src/knowledge/knowledge.controller.ts - Playbooks
apps/api/src/playbooks/playbooks.controller.ts - User administration
apps/api/src/users/users.controller.ts - Nest application
apps/api/src/app.module.ts
Identity and access
- JWT authentication
apps/api/src/auth/auth.controller.ts - Token and session service
apps/api/src/auth/auth.service.ts
Persistence
- Prisma data access
apps/api/src/prisma/prisma.service.ts - PostgreSQL
Other components
- SOC analyst
Connections 25
- SOC analyst → Workspace UI: uses
README.md - Workspace UI → Web feature services: invokes
- Web feature services → Authenticated API client: calls
apps/web/features/cases/service.ts - Web auth → Authenticated API client: calls
apps/web/features/auth/service.ts - Authenticated API client → JWT authentication: sends REST requests
apps/web/lib/server/api-client.ts - JWT authentication → Token and session service: delegates
apps/api/src/auth/auth.controller.ts - Token and session service → Prisma data access: reads and writes
apps/api/src/auth/auth.service.ts - Prisma data access → PostgreSQL: persists data
- Nest application → Alert queue: registers module
apps/api/src/app.module.ts - Nest application → Case workflow: registers module
apps/api/src/app.module.ts - Alert queue → Case workflow: feeds case work
README.md - Case workflow → Evidence files: anchors evidence
apps/api/src/evidence/evidence.controller.ts - Case workflow → Hypotheses: anchors hypotheses
apps/api/src/investigations/investigations.controller.ts - Case workflow → Case timeline: records activity
README.md - Case workflow → Case knowledge links: links references
- Case workflow → Knowledge library: references content
README.md - SOC analyst → Playbooks: uses
- SOC analyst → User administration: administers
- Nest application → JWT authentication: registers module
apps/api/src/app.module.ts - Nest application → Knowledge library: registers module
apps/api/src/app.module.ts - Nest application → Playbooks: registers module
apps/api/src/app.module.ts - Nest application → Case timeline: registers module
apps/api/src/app.module.ts - Nest application → Case knowledge links: registers module
apps/api/src/app.module.ts - Nest application → User administration: registers module
apps/api/src/app.module.ts - Nest application → Prisma data access: registers module
apps/api/src/app.module.ts