System Architecture

A modern, decoupled stack built for speed, extensibility, and real-time threat intelligence.

Frontend

  • ▸ Next.js 16 (React 19)
  • ▸ Framer Motion Animations
  • ▸ Recharts Data Visualizations
  • ▸ Lucide React Icon System
  • ▸ Real-time WebSocket Updates

Backend

  • ▸ FastAPI (Python 3.11+)
  • ▸ SQLAlchemy ORM + SQLite
  • ▸ Groq / Google AI Integration
  • ▸ Rule-Based Risk Scoring Engine
  • ▸ Multi-Format Log Parser

Data Flow Pipeline

Log Upload→Format Detection→Event Parsing→Threat Detection→Risk Scoring→AI Analysis→Dashboard

Risk Scoring Architecture

The risk engine uses an extensible, object-oriented rule system. Each threat type (brute force, privilege escalation, impossible travel, data exfiltration, etc.) is implemented as an independent RiskRule class that evaluates events and returns weighted impact scores. Rules are dynamically registered, making the engine fully pluggable.

The aggregated score (0–100) maps to severity bands: Low (0–24), Medium (25–49), High (50–74), Critical (75–100).