# tejaskedarpawar/sentinel-ai architecture

> Architecture diagram of the GitHub repository tejaskedarpawar/sentinel-ai, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/tejaskedarpawar/sentinel-ai
- Repository: https://github.com/tejaskedarpawar/sentinel-ai

## Overview

Sentinel AI detects privacy-preserving insider-threat patterns from endpoint metadata, scores and explains employee-day risks, and presents alerts and threat relationships to SOC analysts. The main workflow is collection (simulated by default, with an optional live collector), Redis queuing, behavioral profiling, ensemble detection, risk scoring, explanation, and persistence; FastAPI serves results to the React dashboard. The README documents the full pipeline and dashboard capabilities; some router and frontend API internals were not sampled, so their wiring is shown only where documented or evident from sampled callers.

Main entry points: [`backend/app/pipeline.py`](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/pipeline.py) (Pipeline orchestrator), [`frontend/src/App.jsx`](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/frontend/src/App.jsx) (Dashboard application), [`backend/app/database.py`](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/database.py) (Database access), [`backend/app/detection/engine.py`](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/detection/engine.py) (Detection ensemble)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Metadata collection"]
  node_simulator["Activity simulator<br/>[simulator.py]"]
  node_live["Live collector<br/>[live_collector.py]"]
  node_redis["Redis event queue"]
end

subgraph group_analysis["Risk analysis"]
  node_pipeline["Pipeline orchestrator<br/>[pipeline.py]"]
  node_profiling["Behavior profiling<br/>[profiling.py]"]
  node_detection["Detection ensemble<br/>[engine.py]"]
  node_autoencoder["Autoencoder model<br/>[autoencoder.py]"]
  node_lstm["LSTM model<br/>[lstm.py]"]
  node_risk["Risk scoring<br/>[risk_engine.py]"]
  node_agent["Alert explanations<br/>[agent.py]"]
  node_graphbuilder["Threat graph builder<br/>[graph.py]"]
end

subgraph group_serving["API and storage"]
  node_database["Database access<br/>[database.py]"]
  node_postgres[("PostgreSQL")]
  node_main["FastAPI application<br/>[main.py]"]
  node_routers["API routers"]
end

subgraph group_dashboard["SOC dashboard"]
  node_app["Dashboard application<br/>[App.jsx]"]
  node_api["API client<br/>[api.js]"]
  node_panels["Dashboard panels"]
  node_threatview["Threat graph view<br/>[ThreatGraph.jsx]"]
end

node_analyst(("SOC analyst"))

node_analyst -->|"uses dashboard"| node_app
node_pipeline -->|"generates events"| node_simulator
node_pipeline -->|"pushes and drains"| node_redis
node_live -.->|"pushes events"| node_redis
node_pipeline -->|"builds features"| node_profiling
node_pipeline -->|"scores features"| node_detection
node_detection -->|"fits and scores"| node_autoencoder
node_detection -->|"fits and scores"| node_lstm
node_pipeline -->|"computes risk"| node_risk
node_pipeline -->|"explains flagged days"| node_agent
node_pipeline -->|"builds and persists graph"| node_graphbuilder
node_pipeline -->|"opens session"| node_database
node_database -->|"connects to"| node_postgres
node_main -->|"initializes tables"| node_database
node_main -->|"registers routes"| node_routers
node_routers -->|"reads records"| node_database
node_app -->|"requests dashboard data"| node_api
node_api -->|"calls backend API"| node_main
node_app -->|"renders dashboard"| node_panels
node_app -->|"renders graph view"| node_threatview

click node_pipeline "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/pipeline.py"
click node_simulator "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/collectors/simulator.py"
click node_live "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/collectors/live_collector.py"
click node_profiling "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/profiling.py"
click node_detection "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/detection/engine.py"
click node_autoencoder "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/detection/autoencoder.py"
click node_lstm "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/detection/lstm.py"
click node_risk "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/risk_engine.py"
click node_agent "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/agent.py"
click node_graphbuilder "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/graph.py"
click node_database "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/database.py"
click node_main "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/main.py"
click node_routers "https://github.com/tejaskedarpawar/sentinel-ai/tree/main/backend/app/routers"
click node_app "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/frontend/src/App.jsx"
click node_api "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/frontend/src/api.js"
click node_panels "https://github.com/tejaskedarpawar/sentinel-ai/tree/main/frontend/src/components"
click node_threatview "https://github.com/tejaskedarpawar/sentinel-ai/blob/main/frontend/src/components/ThreatGraph.jsx"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_simulator,node_live,node_redis toneBlue
class node_pipeline,node_profiling,node_detection,node_autoencoder,node_lstm,node_risk,node_agent,node_graphbuilder toneAmber
class node_database,node_postgres,node_main,node_routers toneMint
class node_app,node_api,node_panels,node_threatview toneRose
class node_analyst toneIndigo
```

## Components

### Metadata collection

- [Activity simulator](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/collectors/simulator.py): `backend/app/collectors/simulator.py`
- [Live collector](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/collectors/live_collector.py): `backend/app/collectors/live_collector.py`
- **Redis event queue**

### Risk analysis

- [Pipeline orchestrator](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/pipeline.py): `backend/app/pipeline.py`
- [Behavior profiling](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/profiling.py): `backend/app/profiling.py`
- [Detection ensemble](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/detection/engine.py): `backend/app/detection/engine.py`
- [Autoencoder model](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/detection/autoencoder.py): `backend/app/detection/autoencoder.py`
- [LSTM model](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/detection/lstm.py): `backend/app/detection/lstm.py`
- [Risk scoring](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/risk_engine.py): `backend/app/risk_engine.py`
- [Alert explanations](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/agent.py): `backend/app/agent.py`
- [Threat graph builder](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/graph.py): `backend/app/graph.py`

### API and storage

- [Database access](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/database.py): `backend/app/database.py`
- **PostgreSQL**
- [FastAPI application](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/backend/app/main.py): `backend/app/main.py`
- [API routers](https://github.com/tejaskedarpawar/sentinel-ai/tree/main/backend/app/routers): `backend/app/routers`

### SOC dashboard

- [Dashboard application](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [API client](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/frontend/src/api.js): `frontend/src/api.js`
- [Dashboard panels](https://github.com/tejaskedarpawar/sentinel-ai/tree/main/frontend/src/components): `frontend/src/components`
- [Threat graph view](https://github.com/tejaskedarpawar/sentinel-ai/blob/main/frontend/src/components/ThreatGraph.jsx): `frontend/src/components/ThreatGraph.jsx`

### Other components

- **SOC analyst**

## Connections

- SOC analyst → Dashboard application: uses dashboard
- Pipeline orchestrator → Activity simulator: generates events
- Pipeline orchestrator → Redis event queue: pushes and drains
- Live collector → Redis event queue: pushes events
- Pipeline orchestrator → Behavior profiling: builds features
- Pipeline orchestrator → Detection ensemble: scores features
- Detection ensemble → Autoencoder model: fits and scores
- Detection ensemble → LSTM model: fits and scores
- Pipeline orchestrator → Risk scoring: computes risk
- Pipeline orchestrator → Alert explanations: explains flagged days
- Pipeline orchestrator → Threat graph builder: builds and persists graph
- Pipeline orchestrator → Database access: opens session
- Database access → PostgreSQL: connects to
- FastAPI application → Database access: initializes tables
- FastAPI application → API routers: registers routes
- API routers → Database access: reads records
- Dashboard application → API client: requests dashboard data
- API client → FastAPI application: calls backend API
- Dashboard application → Dashboard panels: renders dashboard
- Dashboard application → Threat graph view: renders graph view