# sunilkandel/securenet-lab architecture

> Architecture diagram of the GitHub repository sunilkandel/securenet-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sunilkandel/securenet-lab
- Repository: https://github.com/sunilkandel/securenet-lab

## Overview

SecureNet Lab is a self-hosted network-monitoring system: attacks against a target server produce logs that the monitor collects and analyzes, then checks suspicious IPs and can ban or alert on them. The README also describes a REST API for live dashboard consumption, Suricata rules, and weekly R reports. Configuration is the principal internal support layer. Several implementation files are empty or only documented, so the graph shows documented capabilities and omits uncertain data wiring; the Java dashboard and external services are not present in the tree.

Main entry points: [`src/config.py`](https://github.com/sunilkandel/securenet-lab/blob/dev/src/config.py) (Central configuration), [`src/orchestrator/main.py`](https://github.com/sunilkandel/securenet-lab/blob/dev/src/orchestrator/main.py) (Pipeline orchestrator), [`src/alerts/alerts.py`](https://github.com/sunilkandel/securenet-lab/blob/dev/src/alerts/alerts.py) (Alert notifications), [`src/collector/collector.py`](https://github.com/sunilkandel/securenet-lab/blob/dev/src/collector/collector.py) (Log collector)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_pipeline["Monitoring pipeline"]
  node_orchestrator["Pipeline orchestrator<br/>[main.py]"]
  node_collector["Log collector<br/>[collector.py]"]
  node_detector["Attack detector<br/>[detector.py]"]
  node_suricata["Suricata rules<br/>[custom.rules]"]
end

subgraph group_response["Threat response"]
  node_threatintel["IP reputation<br/>[threat_intel.py]"]
  node_abuseipdb["AbuseIPDB"]
  node_autoban["Firewall auto-ban<br/>[auto_ban.py]"]
  node_firewall["Host firewall"]
  node_alerts["Alert notifications<br/>[alerts.py]"]
  node_telegram["Telegram"]
  node_email["Email service"]
end

subgraph group_interfaces["Consumers and reports"]
  node_api["REST API<br/>[server.py]"]
  node_dashboard["Java dashboard"]
  node_analysis["Attack analysis<br/>[attack_analysis.R]"]
end

subgraph group_support["Runtime support"]
  node_config["Central configuration<br/>[config.py]"]
end

node_attacker(("Kali attacker"))
node_target["Target Linux server"]
node_monitor["Monitor host"]

node_attacker -->|"attacks"| node_target
node_target -->|"provides logs"| node_collector
node_monitor -->|"runs"| node_orchestrator
node_orchestrator -->|"dispatches"| node_collector
node_orchestrator -->|"dispatches"| node_detector
node_orchestrator -->|"dispatches"| node_threatintel
node_orchestrator -->|"dispatches"| node_autoban
node_orchestrator -->|"dispatches"| node_alerts
node_collector -->|"supplies logs"| node_detector
node_detector -.->|"uses rules"| node_suricata
node_threatintel -->|"checks IPs"| node_abuseipdb
node_autoban -->|"bans IPs"| node_firewall
node_alerts -->|"sends alerts"| node_telegram
node_alerts -.->|"sends alerts"| node_email
node_api -->|"serves data"| node_dashboard
node_config -->|"configures"| node_orchestrator
node_config -->|"configures"| node_collector
node_config -->|"configures"| node_detector
node_config -->|"configures"| node_threatintel
node_config -->|"configures"| node_autoban
node_config -->|"configures"| node_alerts
node_config -->|"configures"| node_api

click node_orchestrator "https://github.com/sunilkandel/securenet-lab/blob/dev/src/orchestrator/main.py"
click node_collector "https://github.com/sunilkandel/securenet-lab/blob/dev/src/collector/collector.py"
click node_detector "https://github.com/sunilkandel/securenet-lab/blob/dev/src/detector/detector.py"
click node_suricata "https://github.com/sunilkandel/securenet-lab/blob/dev/suricata/rules/custom.rules"
click node_threatintel "https://github.com/sunilkandel/securenet-lab/blob/dev/src/threat_intel/threat_intel.py"
click node_autoban "https://github.com/sunilkandel/securenet-lab/blob/dev/src/auto_ban/auto_ban.py"
click node_alerts "https://github.com/sunilkandel/securenet-lab/blob/dev/src/alerts/alerts.py"
click node_api "https://github.com/sunilkandel/securenet-lab/blob/dev/src/api/server.py"
click node_analysis "https://github.com/sunilkandel/securenet-lab/blob/dev/analysis/scripts/attack_analysis.R"
click node_config "https://github.com/sunilkandel/securenet-lab/blob/dev/src/config.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_orchestrator,node_collector,node_detector,node_suricata toneBlue
class node_threatintel,node_abuseipdb,node_autoban,node_firewall,node_alerts,node_telegram,node_email toneAmber
class node_api,node_dashboard,node_analysis,node_target toneMint
class node_config toneRose
class node_attacker,node_monitor toneIndigo
```

## Components

### Monitoring pipeline

- [Pipeline orchestrator](https://github.com/sunilkandel/securenet-lab/blob/dev/src/orchestrator/main.py): `src/orchestrator/main.py`
- [Log collector](https://github.com/sunilkandel/securenet-lab/blob/dev/src/collector/collector.py): `src/collector/collector.py`
- [Attack detector](https://github.com/sunilkandel/securenet-lab/blob/dev/src/detector/detector.py): `src/detector/detector.py`
- [Suricata rules](https://github.com/sunilkandel/securenet-lab/blob/dev/suricata/rules/custom.rules): `suricata/rules/custom.rules`

### Threat response

- [IP reputation](https://github.com/sunilkandel/securenet-lab/blob/dev/src/threat_intel/threat_intel.py): `src/threat_intel/threat_intel.py`
- **AbuseIPDB**
- [Firewall auto-ban](https://github.com/sunilkandel/securenet-lab/blob/dev/src/auto_ban/auto_ban.py): `src/auto_ban/auto_ban.py`
- **Host firewall**
- [Alert notifications](https://github.com/sunilkandel/securenet-lab/blob/dev/src/alerts/alerts.py): `src/alerts/alerts.py`
- **Telegram**
- **Email service**

### Consumers and reports

- [REST API](https://github.com/sunilkandel/securenet-lab/blob/dev/src/api/server.py): `src/api/server.py`
- **Java dashboard**
- [Attack analysis](https://github.com/sunilkandel/securenet-lab/blob/dev/analysis/scripts/attack_analysis.R): `analysis/scripts/attack_analysis.R`

### Runtime support

- [Central configuration](https://github.com/sunilkandel/securenet-lab/blob/dev/src/config.py): `src/config.py`

### Other components

- **Kali attacker**
- **Target Linux server**
- **Monitor host**

## Connections

- Kali attacker → Target Linux server: attacks
- Target Linux server → Log collector: provides logs
- Monitor host → Pipeline orchestrator: runs
- Pipeline orchestrator → Log collector: dispatches
- Pipeline orchestrator → Attack detector: dispatches
- Pipeline orchestrator → IP reputation: dispatches
- Pipeline orchestrator → Firewall auto-ban: dispatches
- Pipeline orchestrator → Alert notifications: dispatches
- Log collector → Attack detector: supplies logs
- Attack detector → Suricata rules: uses rules
- IP reputation → AbuseIPDB: checks IPs
- Firewall auto-ban → Host firewall: bans IPs
- Alert notifications → Telegram: sends alerts
- Alert notifications → Email service: sends alerts
- REST API → Java dashboard: serves data
- Central configuration → Pipeline orchestrator: configures
- Central configuration → Log collector: configures
- Central configuration → Attack detector: configures
- Central configuration → IP reputation: configures
- Central configuration → Firewall auto-ban: configures
- Central configuration → Alert notifications: configures
- Central configuration → REST API: configures