How syrrus-ali/bantis works
Bantis combines a self-hosted target range, attack-simulation scenarios, and an event-ingestion/correlation service. The principal workflow is an operator running a guarded scenario against the range; it emits a structured event, which can be ingested and stored by the Detection Engine. The README says scenario events are not yet consumed in the current M2 setup, so the event-to-engine connection is shown as optional. Correlation code exists, but its invocation is not established by the sampled source. No AI-response implementation is represented.
Main entry points: base.py Scenario contract · replay.py Replay registry · tasks.py Task routes · main.py Range API
Components 22
Target Range
- Nginx ingress
range/nginx/default.conf - Range API
range/api/app/main.py - Authentication routes
range/api/app/routers/auth.py - Task routes
range/api/app/routers/tasks.py - Token security
range/api/app/security.py - Range database
range/api/app/db.py - Task cache
range/api/app/cache.py
Attack Simulation
- Scenario CLI
attack-sim/cli.py - Replay registry
attack-sim/scenarios/replay.py - Scenario contract
attack-sim/scenarios/base.py - Dependency attack
attack-sim/scenarios/malicious_dependency.py - Leaked-secret attack
attack-sim/scenarios/leaked_secret.py - CI-step attack
attack-sim/scenarios/compromised_ci_step.py - Typosquatting attack
attack-sim/scenarios/typosquatting.py - No-op scenario
attack-sim/scenarios/noop.py
Detection Engine
- Event ingestion
detection-engine/app/routers/events.py - Detection service
detection-engine/app/main.py - Event store
detection-engine/app/event_models.py - Incident correlation
detection-engine/app/correlation.py - Incident records
detection-engine/app/incident_models.py
Other components
- Operator
- Range client
Connections 28
- Range client → Nginx ingress: sends requests
- Nginx ingress → Range API: proxies requests
- Range API → Authentication routes: dispatches auth
- Range API → Task routes: dispatches tasks
- Authentication routes → Token security: uses token functions
- Task routes → Token security: checks user
- Authentication routes → Range database: reads/writes users
- Task routes → Range database: reads/writes tasks
- Task routes → Task cache: reads/writes cache
- Operator → Scenario CLI: runs commands
- Scenario CLI → Replay registry: runs scenario
- Scenario CLI → Scenario contract: checks/cleans up
- Replay registry → Dependency attack: dispatches replay
- Replay registry → Leaked-secret attack: dispatches replay
- Replay registry → CI-step attack: dispatches replay
- Replay registry → Typosquatting attack: dispatches replay
- Replay registry → No-op scenario: dispatches replay
- Dependency attack → Scenario contract: implements contract
- Leaked-secret attack → Scenario contract: implements contract
- CI-step attack → Scenario contract: implements contract
- Typosquatting attack → Scenario contract: implements contract
- No-op scenario → Scenario contract: implements contract
- Dependency attack → Range API: edits build dependency
- Scenario contract → Event ingestion: emits event; optional ingestion
- Detection service → Event ingestion: registers routes
- Event ingestion → Event store: stores events
- Incident correlation → Event store: reads events
- Incident correlation → Incident records: writes incidents