Architecture

Architecture

Prohori is one core library used in two run modes.

 log files / app JSON events / dataset CSVs
              |
          parsers  ------>  common event schema
                                  |
              +-------------------+-------------------+
              |                                       |
         rule engine                             ML detectors
         (YAML rules)                            (flows, logs)
              +-------------------+-------------------+
                                  |
                               alerts
                                  |
                    enrichment (IP geo/reputation) <-- SQLite cache
                                  |
                          incident builder  (group, score, map to ATT&CK)
                                  |
              +-------------------+-------------------+
              |                   |                   |
           reports            warehouse           LLM analyst
         md/html/json       + dashboard           (optional)

Run modes

• Batch / CLI mode (no Docker): file in, incidents and report out.
• Pipeline mode (Docker Compose): producers, a Kafka-compatible queue (Redpanda), consumers that normalise, detect and build incidents, a PostgreSQL warehouse with dbt models, Airflow jobs and a dashboard. A file-based lite mode runs the same consumers without Docker.

Package layout

Package	Responsibility
prohori.cli	Typer application and commands
prohori.schema	Pydantic models: Event, Alert, Incident
prohori.parsers	Streaming log parsers and the parser registry
prohori.rules	Rule loader, validator, engine and built-in rules
prohori.enrich	Enrichment providers, cache, rate limiting, offline fixtures
prohori.incidents	Grouping, scoring, ATT&CK mapping
prohori.reports	Report templates, renderers and redaction
prohori.simulate	Labelled attack-scenario log generator
prohori.ml	Datasets, features, training, evaluation, scoring
prohori.pipeline	Producers, consumers, sinks, lite-mode runner
prohori.llm	Provider interface, retrieval, safeguards

The authoritative version of this page is docs/ARCHITECTURE.md; design decisions are recorded in docs/DECISIONS.md.