How zanderconner/medwatch works
MedWatch passively observes clinical-network traffic, identifies protocols and device hints, ships events and asset records to a backend, and presents inventory, analytics, and security findings for operator review. The main runtime spans sensor capture and classification, backend ingestion and correlation, then dashboard reads and asset administration. README-documented demo networks and multi-sensor operation are represented at the boundary; detailed demo wiring is not in the sampled source.
Main entry points: server.js Backend service · App.jsx Operator dashboard · pipeline.rs Event and asset pipeline · routes.js Event and asset ingest
Components 23
Passive sensing
- Packet capture
agents/sensor-agent/src/capture.rs - Sensor runtime
agents/sensor-agent/src/main.rs - Event and asset pipeline
agents/sensor-agent/src/pipeline.rs - Device fingerprinting
agents/fingerprinting/src/lib.rs - DICOM parsing
agents/protocol-parsers/dicom/src/lib.rs - HL7 parsing
agents/protocol-parsers/hl7/src/lib.rs - Backend shipper
agents/sensor-agent/src/shipper.rs
Ingest and security
- Event and asset ingest
backend/ingest/routes.js - Event storage
backend/ingest/events-store.js - Asset inventory updates
backend/asset-inventory/upsert.js - Platform database
backend/db/connection.js - Alert correlation
backend/correlation/rules.js - Alert API
backend/alerting/routes.js - Asset and event API
backend/api/routes.js - Traffic analytics API
backend/analytics/routes.js - Analytics queries
backend/analytics/queries.js - Security findings API
backend/security/routes.js - Security queries
backend/security/queries.js - Inventory and sensor admin
backend/admin/routes.js - Backend service
backend/server.js
Operator dashboard
- Operator dashboard
frontend/src/App.jsx
Clinical network
- Clinical devices
Other components
- Hospital operator
Connections 26
- Clinical devices → Packet capture: emit traffic
- Sensor runtime → Packet capture: start capture
- Sensor runtime → Event and asset pipeline: process packets
- Event and asset pipeline → Device fingerprinting: classify devices
- Event and asset pipeline → DICOM parsing: parse DICOM
- Event and asset pipeline → HL7 parsing: parse HL7
- Sensor runtime → Backend shipper: ship batches
- Backend shipper → Event and asset ingest: POST events and assets
- Event and asset ingest → Event storage: insert events
- Event and asset ingest → Asset inventory updates: upsert assets
- Asset and event API → Platform database: read assets and events
- Backend service → Event and asset ingest: mount routes
- Backend service → Asset and event API: mount routes
- Backend service → Alert API: mount routes
- Backend service → Inventory and sensor admin: mount routes
- Backend service → Traffic analytics API: mount routes
- Backend service → Security findings API: mount routes
- Backend service → Alert correlation: run periodically
- Alert API → Alert correlation: run on request
- Traffic analytics API → Analytics queries: query metrics
- Security findings API → Security queries: query findings
- Operator dashboard → Asset and event API: fetch inventory and traffic
- Operator dashboard → Traffic analytics API: fetch analytics
- Operator dashboard → Security findings API: fetch security data
- Operator dashboard → Inventory and sensor admin: manage inventory
- Hospital operator → Operator dashboard: review and manage