How sanjeevandev/attacktrace works
ATTACKTRACE turns security logs into enriched events and correlated attack incidents, then exposes them for investigation and response. The main workflow is documented and partly visible in the pipeline, parser, correlator, and API excerpts. The graph also preserves documented graph export, dashboard, threat-intelligence, playbook, forensic-report, and WebSocket capabilities. Some API routes and integrations are only partially sampled, so uncertain internal wiring is omitted; the incident state is shown as API-managed in-memory state, not a persistent database.
Main entry points: api.py REST and stream API · pipeline.py Pipeline orchestrator · main.py CLI entry point · parser.py Security parser
Components 20
Detection pipeline
- Pipeline orchestrator
src/pipeline.py - Log collector
src/collector.py - Security parser
src/parser.py - MITRE mapper
src/mitre_mapper.py - Threat correlator
src/correlation.py - Event and incident models
src/models.py
Investigation API
- REST and stream API
src/api.py - Incident state
src/api.py - Alert broadcaster
src/websocket_manager.py
Threat response
- Threat intelligence
src/threat_intel.py - Mitigation playbooks
src/playbooks.py - Forensic reporter
src/reporter.py
Visualization and reports
- Incident graph and dashboard
src/visualizer.py - SOC dashboard template
templates/dashboard.html - Timeline renderer
src/timeline.py
User interfaces
- CLI entry point
main.py
Other components
- Security telemetry
- API client
- SOC analyst
- Stream simulator
scripts/simulate_stream.py
Connections 19
- Security telemetry → API client: submits logs
- API client → REST and stream API: sends requests
- SOC analyst → REST and stream API: opens dashboard
- REST and stream API → Pipeline orchestrator: runs ingestion
- Pipeline orchestrator → Log collector: ingests logs
- Pipeline orchestrator → Security parser: enriches events
- Security parser → MITRE mapper: maps indicators
- Pipeline orchestrator → Threat correlator: correlates events
- REST and stream API → Incident state: reads and updates
- Pipeline orchestrator → Incident state: returns incidents
- REST and stream API → Threat intelligence: enriches incidents
- REST and stream API → Alert broadcaster: broadcasts alerts
- REST and stream API → Incident graph and dashboard: exports incident graph
- REST and stream API → Mitigation playbooks: generates mitigations
- REST and stream API → Forensic reporter: generates reports
- REST and stream API → SOC dashboard template: serves template
- CLI entry point → Pipeline orchestrator: runs analysis
- CLI entry point → Timeline renderer: renders incidents
- Stream simulator → REST and stream API: posts stream events