# zanderconner/medwatch architecture

> Architecture diagram of the GitHub repository zanderconner/medwatch, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zanderconner/medwatch
- Repository: https://github.com/zanderconner/medwatch

## Overview

MedWatch passively observes clinical-network traffic, identifies protocols and device hints, ships events and asset records to a backend, and presents inventory, analytics, and security findings for operator review. The main runtime spans sensor capture and classification, backend ingestion and correlation, then dashboard reads and asset administration. README-documented demo networks and multi-sensor operation are represented at the boundary; detailed demo wiring is not in the sampled source.

Main entry points: [`backend/server.js`](https://github.com/zanderconner/medwatch/blob/main/backend/server.js) (Backend service), [`frontend/src/App.jsx`](https://github.com/zanderconner/medwatch/blob/main/frontend/src/App.jsx) (Operator dashboard), [`agents/sensor-agent/src/pipeline.rs`](https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/pipeline.rs) (Event and asset pipeline), [`backend/ingest/routes.js`](https://github.com/zanderconner/medwatch/blob/main/backend/ingest/routes.js) (Event and asset ingest)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_sensor["Passive sensing"]
  node_capture["Packet capture<br/>[capture.rs]"]
  node_sensor_main["Sensor runtime<br/>[main.rs]"]
  node_pipeline["Event and asset pipeline<br/>[pipeline.rs]"]
  node_fingerprinting["Device fingerprinting<br/>[lib.rs]"]
  node_dicom["DICOM parsing<br/>[lib.rs]"]
  node_hl7["HL7 parsing<br/>[lib.rs]"]
  node_shipper["Backend shipper<br/>[shipper.rs]"]
end

subgraph group_backend["Ingest and security"]
  node_ingest_routes["Event and asset ingest<br/>[routes.js]"]
  node_event_store["Event storage<br/>[events-store.js]"]
  node_asset_upsert["Asset inventory updates<br/>[upsert.js]"]
  node_database[("Platform database<br/>[connection.js]")]
  node_correlation["Alert correlation<br/>[rules.js]"]
  node_alert_routes["Alert API<br/>[routes.js]"]
  node_api_routes["Asset and event API<br/>[routes.js]"]
  node_analytics_routes["Traffic analytics API<br/>[routes.js]"]
  node_analytics_queries["Analytics queries<br/>[queries.js]"]
  node_security_routes["Security findings API<br/>[routes.js]"]
  node_security_queries["Security queries<br/>[queries.js]"]
  node_admin_routes["Inventory and sensor admin<br/>[routes.js]"]
  node_server["Backend service<br/>[server.js]"]
end

subgraph group_operator["Operator dashboard"]
  node_dashboard["Operator dashboard<br/>[App.jsx]"]
end

subgraph group_demo["Clinical network"]
  node_devices(("Clinical devices"))
end

node_operator(("Hospital operator"))

node_devices -->|"emit traffic"| node_capture
node_sensor_main -->|"start capture"| node_capture
node_sensor_main -->|"process packets"| node_pipeline
node_pipeline -->|"classify devices"| node_fingerprinting
node_pipeline -->|"parse DICOM"| node_dicom
node_pipeline -->|"parse HL7"| node_hl7
node_sensor_main -->|"ship batches"| node_shipper
node_shipper -->|"POST events and assets"| node_ingest_routes
node_ingest_routes -->|"insert events"| node_event_store
node_ingest_routes -->|"upsert assets"| node_asset_upsert
node_api_routes -->|"read assets and events"| node_database
node_server -->|"mount routes"| node_ingest_routes
node_server -->|"mount routes"| node_api_routes
node_server -->|"mount routes"| node_alert_routes
node_server -->|"mount routes"| node_admin_routes
node_server -->|"mount routes"| node_analytics_routes
node_server -->|"mount routes"| node_security_routes
node_server -->|"run periodically"| node_correlation
node_alert_routes -->|"run on request"| node_correlation
node_analytics_routes -->|"query metrics"| node_analytics_queries
node_security_routes -->|"query findings"| node_security_queries
node_dashboard -->|"fetch inventory and traffic"| node_api_routes
node_dashboard -->|"fetch analytics"| node_analytics_routes
node_dashboard -->|"fetch security data"| node_security_routes
node_dashboard -->|"manage inventory"| node_admin_routes
node_operator -->|"review and manage"| node_dashboard

click node_capture "https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/capture.rs"
click node_sensor_main "https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/main.rs"
click node_pipeline "https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/pipeline.rs"
click node_fingerprinting "https://github.com/zanderconner/medwatch/blob/main/agents/fingerprinting/src/lib.rs"
click node_dicom "https://github.com/zanderconner/medwatch/blob/main/agents/protocol-parsers/dicom/src/lib.rs"
click node_hl7 "https://github.com/zanderconner/medwatch/blob/main/agents/protocol-parsers/hl7/src/lib.rs"
click node_shipper "https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/shipper.rs"
click node_ingest_routes "https://github.com/zanderconner/medwatch/blob/main/backend/ingest/routes.js"
click node_event_store "https://github.com/zanderconner/medwatch/blob/main/backend/ingest/events-store.js"
click node_asset_upsert "https://github.com/zanderconner/medwatch/blob/main/backend/asset-inventory/upsert.js"
click node_database "https://github.com/zanderconner/medwatch/blob/main/backend/db/connection.js"
click node_correlation "https://github.com/zanderconner/medwatch/blob/main/backend/correlation/rules.js"
click node_alert_routes "https://github.com/zanderconner/medwatch/blob/main/backend/alerting/routes.js"
click node_api_routes "https://github.com/zanderconner/medwatch/blob/main/backend/api/routes.js"
click node_analytics_routes "https://github.com/zanderconner/medwatch/blob/main/backend/analytics/routes.js"
click node_analytics_queries "https://github.com/zanderconner/medwatch/blob/main/backend/analytics/queries.js"
click node_security_routes "https://github.com/zanderconner/medwatch/blob/main/backend/security/routes.js"
click node_security_queries "https://github.com/zanderconner/medwatch/blob/main/backend/security/queries.js"
click node_admin_routes "https://github.com/zanderconner/medwatch/blob/main/backend/admin/routes.js"
click node_server "https://github.com/zanderconner/medwatch/blob/main/backend/server.js"
click node_dashboard "https://github.com/zanderconner/medwatch/blob/main/frontend/src/App.jsx"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_capture,node_sensor_main,node_pipeline,node_fingerprinting,node_dicom,node_hl7,node_shipper toneBlue
class node_ingest_routes,node_event_store,node_asset_upsert,node_database,node_correlation,node_alert_routes,node_api_routes,node_analytics_routes,node_analytics_queries,node_security_routes,node_security_queries,node_admin_routes,node_server toneAmber
class node_dashboard toneMint
class node_devices toneRose
class node_operator toneIndigo
```

## Components

### Passive sensing

- [Packet capture](https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/capture.rs): `agents/sensor-agent/src/capture.rs`
- [Sensor runtime](https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/main.rs): `agents/sensor-agent/src/main.rs`
- [Event and asset pipeline](https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/pipeline.rs): `agents/sensor-agent/src/pipeline.rs`
- [Device fingerprinting](https://github.com/zanderconner/medwatch/blob/main/agents/fingerprinting/src/lib.rs): `agents/fingerprinting/src/lib.rs`
- [DICOM parsing](https://github.com/zanderconner/medwatch/blob/main/agents/protocol-parsers/dicom/src/lib.rs): `agents/protocol-parsers/dicom/src/lib.rs`
- [HL7 parsing](https://github.com/zanderconner/medwatch/blob/main/agents/protocol-parsers/hl7/src/lib.rs): `agents/protocol-parsers/hl7/src/lib.rs`
- [Backend shipper](https://github.com/zanderconner/medwatch/blob/main/agents/sensor-agent/src/shipper.rs): `agents/sensor-agent/src/shipper.rs`

### Ingest and security

- [Event and asset ingest](https://github.com/zanderconner/medwatch/blob/main/backend/ingest/routes.js): `backend/ingest/routes.js`
- [Event storage](https://github.com/zanderconner/medwatch/blob/main/backend/ingest/events-store.js): `backend/ingest/events-store.js`
- [Asset inventory updates](https://github.com/zanderconner/medwatch/blob/main/backend/asset-inventory/upsert.js): `backend/asset-inventory/upsert.js`
- [Platform database](https://github.com/zanderconner/medwatch/blob/main/backend/db/connection.js): `backend/db/connection.js`
- [Alert correlation](https://github.com/zanderconner/medwatch/blob/main/backend/correlation/rules.js): `backend/correlation/rules.js`
- [Alert API](https://github.com/zanderconner/medwatch/blob/main/backend/alerting/routes.js): `backend/alerting/routes.js`
- [Asset and event API](https://github.com/zanderconner/medwatch/blob/main/backend/api/routes.js): `backend/api/routes.js`
- [Traffic analytics API](https://github.com/zanderconner/medwatch/blob/main/backend/analytics/routes.js): `backend/analytics/routes.js`
- [Analytics queries](https://github.com/zanderconner/medwatch/blob/main/backend/analytics/queries.js): `backend/analytics/queries.js`
- [Security findings API](https://github.com/zanderconner/medwatch/blob/main/backend/security/routes.js): `backend/security/routes.js`
- [Security queries](https://github.com/zanderconner/medwatch/blob/main/backend/security/queries.js): `backend/security/queries.js`
- [Inventory and sensor admin](https://github.com/zanderconner/medwatch/blob/main/backend/admin/routes.js): `backend/admin/routes.js`
- [Backend service](https://github.com/zanderconner/medwatch/blob/main/backend/server.js): `backend/server.js`

### Operator dashboard

- [Operator dashboard](https://github.com/zanderconner/medwatch/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`

### Clinical network

- **Clinical devices**

### Other components

- **Hospital operator**

## Connections

- Clinical devices → Packet capture: emit traffic
- Sensor runtime → Packet capture: start capture
- Sensor runtime → Event and asset pipeline: process packets
- Event and asset pipeline → Device fingerprinting: classify devices
- Event and asset pipeline → DICOM parsing: parse DICOM
- Event and asset pipeline → HL7 parsing: parse HL7
- Sensor runtime → Backend shipper: ship batches
- Backend shipper → Event and asset ingest: POST events and assets
- Event and asset ingest → Event storage: insert events
- Event and asset ingest → Asset inventory updates: upsert assets
- Asset and event API → Platform database: read assets and events
- Backend service → Event and asset ingest: mount routes
- Backend service → Asset and event API: mount routes
- Backend service → Alert API: mount routes
- Backend service → Inventory and sensor admin: mount routes
- Backend service → Traffic analytics API: mount routes
- Backend service → Security findings API: mount routes
- Backend service → Alert correlation: run periodically
- Alert API → Alert correlation: run on request
- Traffic analytics API → Analytics queries: query metrics
- Security findings API → Security queries: query findings
- Operator dashboard → Asset and event API: fetch inventory and traffic
- Operator dashboard → Traffic analytics API: fetch analytics
- Operator dashboard → Security findings API: fetch security data
- Operator dashboard → Inventory and sensor admin: manage inventory
- Hospital operator → Operator dashboard: review and manage