# zhadyz/ai_soc architecture

> Architecture diagram of the GitHub repository zhadyz/ai_soc, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zhadyz/ai_soc
- Repository: https://github.com/zhadyz/ai_soc

## Overview

AI-SOC is a local research security-operations platform. Wazuh alerts enter through a receiver, receive AI triage and knowledge enrichment, and can be correlated into incidents for analyst review or response planning; analysts can also review feedback and detection-rule drafts. The README documents the broader ML, simulation, retraining, and rollback capabilities. Edges reflect excerpted calls or documented service behavior; unsampled implementation details and wiring are not inferred.

Main entry points: [`dashboard/app.py`](https://github.com/zhadyz/ai_soc/blob/master/dashboard/app.py) (SOC Dashboard), [`services/alert-triage/llm_client.py`](https://github.com/zhadyz/ai_soc/blob/master/services/alert-triage/llm_client.py) (Alert Triage), [`services/wazuh-integration/main.py`](https://github.com/zhadyz/ai_soc/blob/master/services/wazuh-integration/main.py) (Wazuh Receiver), [`services/common/api_security.py`](https://github.com/zhadyz/ai_soc/blob/master/services/common/api_security.py) (API Security)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_access["Analyst Access"]
  node_dashboard["SOC Dashboard<br/>[app.py]"]
  node_auth["Identity and Roles<br/>[authentication.py]"]
end

subgraph group_detection["Alert Analysis"]
  node_receiver["Wazuh Receiver<br/>[main.py]"]
  node_triage["Alert Triage<br/>[llm_client.py]"]
  node_ml["Flow Inference<br/>[inference_api.py]"]
  node_ollama["Local LLM"]
end

subgraph group_knowledge["Knowledge and Learning"]
  node_rag["Knowledge Retrieval<br/>[main.py]"]
  node_knowledgebase["Knowledge Base<br/>[knowledge_base.py]"]
  node_feedback[("Feedback and Reviews<br/>[main.py]")]
  node_retraining["Model Retraining<br/>[retrain.py]"]
end

subgraph group_incident["Incident Response"]
  node_correlation["Incident Correlation<br/>[main.py]"]
  node_simulation["Attack Simulation<br/>[simulator.py]"]
  node_response["Response Plans<br/>[orchestrator.py]"]
  node_responseapi["Response API<br/>[main.py]"]
  node_rules["Sigma Rule Workflow<br/>[main.py]"]
end

subgraph group_shared["Shared Services"]
  node_identity["Token Identity<br/>[identity.py]"]
  node_api_security["API Security<br/>[api_security.py]"]
  node_flow_schema["Flow Schema<br/>[flow_schema.py]"]
  node_integration["Service Integration<br/>[integration.py]"]
  node_pipeline["Pipeline Orchestration<br/>[pipeline.py]"]
  node_model_integrity["Model Integrity<br/>[model_integrity.py]"]
  node_rate_limit["Rate Limiting<br/>[rate_limit.py]"]
  node_tls["TLS Helpers<br/>[tls.py]"]
end

node_analyst(("Analyst"))

node_analyst -->|"uses"| node_dashboard
node_dashboard -->|"installs auth"| node_auth
node_auth -->|"authenticates"| node_identity
node_auth -->|"limits requests"| node_rate_limit
node_dashboard -->|"proxies reviews"| node_feedback
node_dashboard -->|"proxies rule review"| node_rules
node_receiver -->|"queues alerts"| node_triage
node_receiver -->|"requests enrichment"| node_rag
node_receiver -->|"submits enriched alerts"| node_correlation
node_triage -->|"analyzes alerts"| node_ollama
node_triage -->|"requests prediction"| node_ml
node_triage -->|"retrieves context"| node_rag
node_rag -.->|"retrieves documents"| node_knowledgebase
node_dashboard -->|"views incidents"| node_correlation
node_dashboard -->|"reviews plans"| node_responseapi
node_correlation -->|"triggers defense"| node_responseapi
node_responseapi -->|"dispatches plans"| node_response
node_response -->|"uses predictions"| node_simulation
node_dashboard -->|"submits analyst labels"| node_feedback
node_retraining -->|"promotes model bundle"| node_ml
node_receiver -->|"protects API"| node_api_security
node_triage -->|"validates flow inputs"| node_flow_schema
node_dashboard -->|"uses service credentials"| node_api_security
node_api_security -->|"verifies tokens"| node_identity
node_api_security -->|"limits API calls"| node_rate_limit
node_pipeline -->|"uses clients"| node_integration
node_ml -->|"verifies artifacts"| node_model_integrity
node_response -->|"uses Wazuh adapter"| node_tls

click node_dashboard "https://github.com/zhadyz/ai_soc/blob/master/dashboard/app.py"
click node_auth "https://github.com/zhadyz/ai_soc/blob/master/dashboard/authentication.py"
click node_receiver "https://github.com/zhadyz/ai_soc/blob/master/services/wazuh-integration/main.py"
click node_triage "https://github.com/zhadyz/ai_soc/blob/master/services/alert-triage/llm_client.py"
click node_ml "https://github.com/zhadyz/ai_soc/blob/master/ml_training/inference_api.py"
click node_rag "https://github.com/zhadyz/ai_soc/blob/master/services/rag-service/main.py"
click node_knowledgebase "https://github.com/zhadyz/ai_soc/blob/master/services/rag-service/knowledge_base.py"
click node_feedback "https://github.com/zhadyz/ai_soc/blob/master/services/feedback-service/main.py"
click node_retraining "https://github.com/zhadyz/ai_soc/blob/master/services/retraining/retrain.py"
click node_correlation "https://github.com/zhadyz/ai_soc/blob/master/services/correlation-engine/main.py"
click node_simulation "https://github.com/zhadyz/ai_soc/blob/master/services/correlation-engine/simulator.py"
click node_response "https://github.com/zhadyz/ai_soc/blob/master/services/response-orchestrator/orchestrator.py"
click node_responseapi "https://github.com/zhadyz/ai_soc/blob/master/services/response-orchestrator/main.py"
click node_rules "https://github.com/zhadyz/ai_soc/blob/master/services/rule-generator/main.py"
click node_identity "https://github.com/zhadyz/ai_soc/blob/master/services/common/identity.py"
click node_api_security "https://github.com/zhadyz/ai_soc/blob/master/services/common/api_security.py"
click node_flow_schema "https://github.com/zhadyz/ai_soc/blob/master/services/common/flow_schema.py"
click node_integration "https://github.com/zhadyz/ai_soc/blob/master/services/common/integration.py"
click node_pipeline "https://github.com/zhadyz/ai_soc/blob/master/services/common/pipeline.py"
click node_model_integrity "https://github.com/zhadyz/ai_soc/blob/master/services/common/model_integrity.py"
click node_rate_limit "https://github.com/zhadyz/ai_soc/blob/master/services/common/rate_limit.py"
click node_tls "https://github.com/zhadyz/ai_soc/blob/master/services/common/tls.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_dashboard,node_auth toneBlue
class node_receiver,node_triage,node_ml,node_ollama toneAmber
class node_rag,node_knowledgebase,node_feedback,node_retraining toneMint
class node_correlation,node_simulation,node_response,node_responseapi,node_rules toneRose
class node_identity,node_api_security,node_flow_schema,node_integration,node_pipeline,node_model_integrity,node_rate_limit,node_tls,node_analyst toneIndigo
```

## Components

### Analyst Access

- [SOC Dashboard](https://github.com/zhadyz/ai_soc/blob/master/dashboard/app.py): `dashboard/app.py`
- [Identity and Roles](https://github.com/zhadyz/ai_soc/blob/master/dashboard/authentication.py): `dashboard/authentication.py`

### Alert Analysis

- [Wazuh Receiver](https://github.com/zhadyz/ai_soc/blob/master/services/wazuh-integration/main.py): `services/wazuh-integration/main.py`
- [Alert Triage](https://github.com/zhadyz/ai_soc/blob/master/services/alert-triage/llm_client.py): `services/alert-triage/llm_client.py`
- [Flow Inference](https://github.com/zhadyz/ai_soc/blob/master/ml_training/inference_api.py): `ml_training/inference_api.py`
- **Local LLM**

### Knowledge and Learning

- [Knowledge Retrieval](https://github.com/zhadyz/ai_soc/blob/master/services/rag-service/main.py): `services/rag-service/main.py`
- [Knowledge Base](https://github.com/zhadyz/ai_soc/blob/master/services/rag-service/knowledge_base.py): `services/rag-service/knowledge_base.py`
- [Feedback and Reviews](https://github.com/zhadyz/ai_soc/blob/master/services/feedback-service/main.py): `services/feedback-service/main.py`
- [Model Retraining](https://github.com/zhadyz/ai_soc/blob/master/services/retraining/retrain.py): `services/retraining/retrain.py`

### Incident Response

- [Incident Correlation](https://github.com/zhadyz/ai_soc/blob/master/services/correlation-engine/main.py): `services/correlation-engine/main.py`
- [Attack Simulation](https://github.com/zhadyz/ai_soc/blob/master/services/correlation-engine/simulator.py): `services/correlation-engine/simulator.py`
- [Response Plans](https://github.com/zhadyz/ai_soc/blob/master/services/response-orchestrator/orchestrator.py): `services/response-orchestrator/orchestrator.py`
- [Response API](https://github.com/zhadyz/ai_soc/blob/master/services/response-orchestrator/main.py): `services/response-orchestrator/main.py`
- [Sigma Rule Workflow](https://github.com/zhadyz/ai_soc/blob/master/services/rule-generator/main.py): `services/rule-generator/main.py`

### Shared Services

- [Token Identity](https://github.com/zhadyz/ai_soc/blob/master/services/common/identity.py): `services/common/identity.py`
- [API Security](https://github.com/zhadyz/ai_soc/blob/master/services/common/api_security.py): `services/common/api_security.py`
- [Flow Schema](https://github.com/zhadyz/ai_soc/blob/master/services/common/flow_schema.py): `services/common/flow_schema.py`
- [Service Integration](https://github.com/zhadyz/ai_soc/blob/master/services/common/integration.py): `services/common/integration.py`
- [Pipeline Orchestration](https://github.com/zhadyz/ai_soc/blob/master/services/common/pipeline.py): `services/common/pipeline.py`
- [Model Integrity](https://github.com/zhadyz/ai_soc/blob/master/services/common/model_integrity.py): `services/common/model_integrity.py`
- [Rate Limiting](https://github.com/zhadyz/ai_soc/blob/master/services/common/rate_limit.py): `services/common/rate_limit.py`
- [TLS Helpers](https://github.com/zhadyz/ai_soc/blob/master/services/common/tls.py): `services/common/tls.py`

### Other components

- **Analyst**

## Connections

- Analyst → SOC Dashboard: uses (evidence: `README.md`)
- SOC Dashboard → Identity and Roles: installs auth (evidence: `dashboard/app.py`)
- Identity and Roles → Token Identity: authenticates (evidence: `dashboard/authentication.py`)
- Identity and Roles → Rate Limiting: limits requests (evidence: `dashboard/authentication.py`)
- SOC Dashboard → Feedback and Reviews: proxies reviews (evidence: `dashboard/app.py`)
- SOC Dashboard → Sigma Rule Workflow: proxies rule review (evidence: `dashboard/app.py`)
- Wazuh Receiver → Alert Triage: queues alerts (evidence: `README.md`)
- Wazuh Receiver → Knowledge Retrieval: requests enrichment (evidence: `services/wazuh-integration/main.py`)
- Wazuh Receiver → Incident Correlation: submits enriched alerts (evidence: `services/wazuh-integration/main.py`)
- Alert Triage → Local LLM: analyzes alerts (evidence: `services/alert-triage/llm_client.py`)
- Alert Triage → Flow Inference: requests prediction (evidence: `services/alert-triage/llm_client.py`)
- Alert Triage → Knowledge Retrieval: retrieves context (evidence: `services/alert-triage/llm_client.py`)
- Knowledge Retrieval → Knowledge Base: retrieves documents
- SOC Dashboard → Incident Correlation: views incidents (evidence: `README.md`)
- SOC Dashboard → Response API: reviews plans (evidence: `README.md`)
- Incident Correlation → Response API: triggers defense (evidence: `services/correlation-engine/main.py`)
- Response API → Response Plans: dispatches plans (evidence: `services/response-orchestrator/main.py`)
- Response Plans → Attack Simulation: uses predictions (evidence: `README.md`)
- SOC Dashboard → Feedback and Reviews: submits analyst labels (evidence: `README.md`)
- Model Retraining → Flow Inference: promotes model bundle (evidence: `README.md`)
- Wazuh Receiver → API Security: protects API (evidence: `services/wazuh-integration/main.py`)
- Alert Triage → Flow Schema: validates flow inputs
- SOC Dashboard → API Security: uses service credentials (evidence: `dashboard/app.py`)
- API Security → Token Identity: verifies tokens (evidence: `services/common/api_security.py`)
- API Security → Rate Limiting: limits API calls (evidence: `services/common/api_security.py`)
- Pipeline Orchestration → Service Integration: uses clients (evidence: `services/common/pipeline.py`)
- Flow Inference → Model Integrity: verifies artifacts (evidence: `ml_training/inference_api.py`)
- Response Plans → TLS Helpers: uses Wazuh adapter