How sunilkandel/securenet-lab works
SecureNet Lab is a self-hosted network-monitoring system: attacks against a target server produce logs that the monitor collects and analyzes, then checks suspicious IPs and can ban or alert on them. The README also describes a REST API for live dashboard consumption, Suricata rules, and weekly R reports. Configuration is the principal internal support layer. Several implementation files are empty or only documented, so the graph shows documented capabilities and omits uncertain data wiring; the Java dashboard and external services are not present in the tree.
Main entry points: config.py Central configuration · main.py Pipeline orchestrator · alerts.py Alert notifications · collector.py Log collector
Components 18
Monitoring pipeline
- Pipeline orchestrator
src/orchestrator/main.py - Log collector
src/collector/collector.py - Attack detector
src/detector/detector.py - Suricata rules
suricata/rules/custom.rules
Threat response
- IP reputation
src/threat_intel/threat_intel.py - AbuseIPDB
- Firewall auto-ban
src/auto_ban/auto_ban.py - Host firewall
- Alert notifications
src/alerts/alerts.py - Telegram
- Email service
Consumers and reports
- REST API
src/api/server.py - Java dashboard
- Attack analysis
analysis/scripts/attack_analysis.R
Runtime support
- Central configuration
src/config.py
Other components
- Kali attacker
- Target Linux server
- Monitor host
Connections 22
- Kali attacker → Target Linux server: attacks
- Target Linux server → Log collector: provides logs
- Monitor host → Pipeline orchestrator: runs
- Pipeline orchestrator → Log collector: dispatches
- Pipeline orchestrator → Attack detector: dispatches
- Pipeline orchestrator → IP reputation: dispatches
- Pipeline orchestrator → Firewall auto-ban: dispatches
- Pipeline orchestrator → Alert notifications: dispatches
- Log collector → Attack detector: supplies logs
- Attack detector → Suricata rules: uses rules
- IP reputation → AbuseIPDB: checks IPs
- Firewall auto-ban → Host firewall: bans IPs
- Alert notifications → Telegram: sends alerts
- Alert notifications → Email service: sends alerts
- REST API → Java dashboard: serves data
- Central configuration → Pipeline orchestrator: configures
- Central configuration → Log collector: configures
- Central configuration → Attack detector: configures
- Central configuration → IP reputation: configures
- Central configuration → Firewall auto-ban: configures
- Central configuration → Alert notifications: configures
- Central configuration → REST API: configures