How smolkar/lateralvision-public- works
Lateral Vision ingests Windows event-log files, normalizes and groups events into domain/device/user and session-related data, then exposes graph queries and database import through a Flask API. Users select a processed dataset and retrieve connections for interactive directed-graph visualization; the API also provides domain summaries and workstation/IP correlation. The README describes anomaly detection, and the processor excerpt includes anomaly scoring and HTML report generation. Several processor sections are unsampled, so only documented or directly evidenced wiring is shown.
Main entry points: processor.py Log Processor · api.py Flask API · index.js Browser UI · compilation.py Session Compilation
Components 19
Ingestion and Analysis
- Log Processor
utils/processor.py - Format Utilities
utils/utils.py - Domain Model
classes/domain.py - Device Model
classes/device.py - User Model
classes/user.py - Session Compilation
classes/compilation.py - Windows Event
classes/event.py - Session Model
classes/session.py - Anomaly Report
anomaly_detector_results.html
API and Selection
- Flask API
api/api.py - Uploads
resources/uploads - Processed Data
resources/processed - Selected Dataset
resources
Graph Data
- Graph Persistence
utils/database.py - Neo4j
Visualization
- Browser UI
force-graph/src/main/index.js - Directed Graph
force-graph/src/main/scripts/directedgraph.js
Other components
- Analyst
- Event Log File
Connections 25
- Analyst → Browser UI: uses
- Event Log File → Flask API: uploads
- Browser UI → Flask API: requests
- Flask API → Uploads: saves file
- Flask API → Log Processor: processes upload
- Log Processor → Uploads: reads upload
- Log Processor → Format Utilities: normalizes
- Log Processor → Processed Data: writes results
- Flask API → Processed Data: selects dataset
- Flask API → Selected Dataset: stores selection
- Flask API → Processed Data: reads selected data
- Flask API → Log Processor: queries connections
- Log Processor → Domain Model: builds domain data
- Log Processor → Device Model: builds device data
- Log Processor → User Model: builds user data
- Log Processor → Session Compilation: groups events
- Log Processor → Windows Event: creates events
- Session Compilation → Windows Event: contains events
- Session Model → Session Compilation: collects compilations
- Flask API → Graph Persistence: imports graph data
- Flask API → Graph Persistence: requests correlation
- Graph Persistence → Neo4j: writes and queries
- Browser UI → Directed Graph: draws results
- Flask API → Browser UI: serves pages
- Log Processor → Anomaly Report: generates report