# seraphimdeck/serad architecture

> Architecture diagram of the GitHub repository seraphimdeck/serad, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/seraphimdeck/serad
- Repository: https://github.com/seraphimdeck/serad

## Overview

serAD is a read-only Active Directory and AD CS audit CLI. An operator supplies target and credentials; the CLI validates the target, connects to LDAP, harvests domain and PKI data, runs AD risk detection plus an HTTP ESC8 probe, then prints and exports findings. The graph preserves the distinct safety, collection, detection, and reporting stages. The README documents broader detection coverage; sampled source confirms the engine’s dispatch and ESC8 probe, but not each detector or harvester’s internals.

Main entry points: [`cmd/serAD/main.go`](https://github.com/seraphimdeck/serad/blob/main/cmd/serAD/main.go) (Audit CLI), [`pkg/detectors/engine.go`](https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/engine.go) (Detection Engine), [`pkg/http/esc8_checker.go`](https://github.com/seraphimdeck/serad/blob/main/pkg/http/esc8_checker.go) (ESC8 Probe), [`pkg/gatekeeper/gatekeeper.go`](https://github.com/seraphimdeck/serad/blob/main/pkg/gatekeeper/gatekeeper.go) (Safety Checks)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_safety["Target Safety"]
  node_gatekeeper["Safety Checks<br/>[gatekeeper.go]"]
  node_ttl["TTL Check<br/>[ttl.go]"]
end

subgraph group_collection["Data Collection"]
  node_ldapclient["LDAP Client<br/>[client.go]"]
  node_domainharvest["Domain Harvest"]
  node_pkiharvest["PKI Harvest<br/>[pki_harvester.go]"]
  node_objects["AD Objects<br/>[ad_objects.go]"]
end

subgraph group_analysis["Risk Analysis"]
  node_engine["Detection Engine<br/>[engine.go]"]
  node_certdetectors["Certificate Risks<br/>[esc1_3.go]"]
  node_otherdetectors["AD Risks<br/>[kerberoast.go]"]
  node_delegation["Delegation Risks<br/>[delegation.go]"]
  node_httpclient["HTTP Probe Client<br/>[client.go]"]
  node_esc8["ESC8 Probe<br/>[esc8_checker.go]"]
  node_findings["Audit Findings<br/>[finding.go]"]
end

subgraph group_reporting["Audit Output"]
  node_metadata["Audit Metadata<br/>[metadata.go]"]
  node_terminal["Terminal Report<br/>[terminal.go]"]
  node_markdown["Markdown Export<br/>[markdown.go]"]
  node_json["JSON Export<br/>[json.go]"]
end

node_operator(("Auditor"))
node_cli["Audit CLI<br/>[main.go]"]
node_ad(("AD Domain Controller"))
node_files["Report Files"]

node_operator -->|"provides options"| node_cli
node_cli -->|"validates target"| node_gatekeeper
node_gatekeeper -->|"checks hop limit"| node_ttl
node_cli -->|"opens LDAP"| node_ldapclient
node_ldapclient -->|"binds and searches"| node_ad
node_cli -->|"harvests domain"| node_domainharvest
node_cli -->|"harvests PKI"| node_pkiharvest
node_domainharvest -->|"produces records"| node_objects
node_pkiharvest -->|"produces records"| node_objects
node_cli -->|"runs detection"| node_engine
node_engine -->|"dispatches checks"| node_certdetectors
node_engine -->|"dispatches checks"| node_otherdetectors
node_engine -->|"dispatches checks"| node_delegation
node_engine -->|"returns findings"| node_findings
node_cli -->|"creates probe client"| node_httpclient
node_cli -->|"checks each CA"| node_esc8
node_esc8 -->|"sends HTTP request"| node_httpclient
node_esc8 -.->|"probes enrollment"| node_ad
node_esc8 -->|"returns finding"| node_findings
node_cli -->|"prints findings"| node_terminal
node_cli -->|"exports findings"| node_markdown
node_cli -->|"exports findings"| node_json
node_cli -->|"supplies metadata"| node_metadata
node_markdown -->|"writes report"| node_files
node_json -->|"writes report"| node_files

click node_cli "https://github.com/seraphimdeck/serad/blob/main/cmd/serAD/main.go"
click node_gatekeeper "https://github.com/seraphimdeck/serad/blob/main/pkg/gatekeeper/gatekeeper.go"
click node_ttl "https://github.com/seraphimdeck/serad/blob/main/pkg/gatekeeper/ttl.go"
click node_ldapclient "https://github.com/seraphimdeck/serad/blob/main/pkg/ldap/client.go"
click node_domainharvest "https://github.com/seraphimdeck/serad/blob/main/pkg/ldap/domain_harvester.go"
click node_pkiharvest "https://github.com/seraphimdeck/serad/blob/main/pkg/ldap/pki_harvester.go"
click node_objects "https://github.com/seraphimdeck/serad/blob/main/pkg/models/ad_objects.go"
click node_engine "https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/engine.go"
click node_certdetectors "https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/esc1_3.go"
click node_otherdetectors "https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/kerberoast.go"
click node_delegation "https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/delegation.go"
click node_httpclient "https://github.com/seraphimdeck/serad/blob/main/pkg/http/client.go"
click node_esc8 "https://github.com/seraphimdeck/serad/blob/main/pkg/http/esc8_checker.go"
click node_findings "https://github.com/seraphimdeck/serad/blob/main/pkg/models/finding.go"
click node_metadata "https://github.com/seraphimdeck/serad/blob/main/pkg/models/metadata.go"
click node_terminal "https://github.com/seraphimdeck/serad/blob/main/pkg/reporter/terminal.go"
click node_markdown "https://github.com/seraphimdeck/serad/blob/main/pkg/reporter/markdown.go"
click node_json "https://github.com/seraphimdeck/serad/blob/main/pkg/reporter/json.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_gatekeeper,node_ttl toneBlue
class node_ldapclient,node_domainharvest,node_pkiharvest,node_objects toneAmber
class node_engine,node_certdetectors,node_otherdetectors,node_delegation,node_httpclient,node_esc8,node_findings toneMint
class node_metadata,node_terminal,node_markdown,node_json toneRose
class node_operator,node_ad,node_files toneIndigo
class node_cli toneTeal
```

## Components

### Target Safety

- [Safety Checks](https://github.com/seraphimdeck/serad/blob/main/pkg/gatekeeper/gatekeeper.go): `pkg/gatekeeper/gatekeeper.go`
- [TTL Check](https://github.com/seraphimdeck/serad/blob/main/pkg/gatekeeper/ttl.go): `pkg/gatekeeper/ttl.go`

### Data Collection

- [LDAP Client](https://github.com/seraphimdeck/serad/blob/main/pkg/ldap/client.go): `pkg/ldap/client.go`
- [Domain Harvest](https://github.com/seraphimdeck/serad/blob/main/pkg/ldap/domain_harvester.go): `pkg/ldap/domain_harvester.go`
- [PKI Harvest](https://github.com/seraphimdeck/serad/blob/main/pkg/ldap/pki_harvester.go): `pkg/ldap/pki_harvester.go`
- [AD Objects](https://github.com/seraphimdeck/serad/blob/main/pkg/models/ad_objects.go): `pkg/models/ad_objects.go`

### Risk Analysis

- [Detection Engine](https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/engine.go): `pkg/detectors/engine.go`
- [Certificate Risks](https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/esc1_3.go): `pkg/detectors/esc1_3.go`
- [AD Risks](https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/kerberoast.go): `pkg/detectors/kerberoast.go`
- [Delegation Risks](https://github.com/seraphimdeck/serad/blob/main/pkg/detectors/delegation.go): `pkg/detectors/delegation.go`
- [HTTP Probe Client](https://github.com/seraphimdeck/serad/blob/main/pkg/http/client.go): `pkg/http/client.go`
- [ESC8 Probe](https://github.com/seraphimdeck/serad/blob/main/pkg/http/esc8_checker.go): `pkg/http/esc8_checker.go`
- [Audit Findings](https://github.com/seraphimdeck/serad/blob/main/pkg/models/finding.go): `pkg/models/finding.go`

### Audit Output

- [Audit Metadata](https://github.com/seraphimdeck/serad/blob/main/pkg/models/metadata.go): `pkg/models/metadata.go`
- [Terminal Report](https://github.com/seraphimdeck/serad/blob/main/pkg/reporter/terminal.go): `pkg/reporter/terminal.go`
- [Markdown Export](https://github.com/seraphimdeck/serad/blob/main/pkg/reporter/markdown.go): `pkg/reporter/markdown.go`
- [JSON Export](https://github.com/seraphimdeck/serad/blob/main/pkg/reporter/json.go): `pkg/reporter/json.go`

### Other components

- **Auditor**
- [Audit CLI](https://github.com/seraphimdeck/serad/blob/main/cmd/serAD/main.go): `cmd/serAD/main.go`
- **AD Domain Controller**
- **Report Files**

## Connections

- Auditor → Audit CLI: provides options
- Audit CLI → Safety Checks: validates target
- Safety Checks → TTL Check: checks hop limit
- Audit CLI → LDAP Client: opens LDAP
- LDAP Client → AD Domain Controller: binds and searches
- Audit CLI → Domain Harvest: harvests domain
- Audit CLI → PKI Harvest: harvests PKI
- Domain Harvest → AD Objects: produces records
- PKI Harvest → AD Objects: produces records
- Audit CLI → Detection Engine: runs detection
- Detection Engine → Certificate Risks: dispatches checks
- Detection Engine → AD Risks: dispatches checks
- Detection Engine → Delegation Risks: dispatches checks
- Detection Engine → Audit Findings: returns findings
- Audit CLI → HTTP Probe Client: creates probe client
- Audit CLI → ESC8 Probe: checks each CA
- ESC8 Probe → HTTP Probe Client: sends HTTP request
- ESC8 Probe → AD Domain Controller: probes enrollment
- ESC8 Probe → Audit Findings: returns finding
- Audit CLI → Terminal Report: prints findings
- Audit CLI → Markdown Export: exports findings
- Audit CLI → JSON Export: exports findings
- Audit CLI → Audit Metadata: supplies metadata
- Markdown Export → Report Files: writes report
- JSON Export → Report Files: writes report