tirreno/
│
├── .github/ # GitHub configuration
│ ├── workflows/ # CI/CD workflows
│ │ └── ci.yml # PHPUnit, PHPStan, PHP_CodeSniffer
│ └── actions/ # Custom GitHub actions
│ └── setup-php/
│
├── tests/ # Test suites (PHPUnit)
│ ├── Unit/ # Unit tests (Assets, Models, Rules, Utils)
│ └── Support/ # Test doubles and helpers
│
├── app/ # Application code
│ ├── Assets/ # Base classes for rules and custom context
│ │ ├── Rule.php # Abstract Rule class
│ │ ├── Context.php # Abstract custom Context class
│ │ └── Constants.php
│ │
│ ├── Controllers/ # Request handlers
│ │ ├── Api/ # API controllers
│ │ │ ├── Blacklist.php # Blacklist API
│ │ │ └── Endpoint.php # API endpoint handler
│ │ ├── Pages/ # Page controllers (render pages)
│ │ │ ├── Cron.php # Cron entry point (/cron)
│ │ │ ├── Login.php
│ │ │ ├── Signup.php
│ │ │ ├── Users.php
│ │ │ └── ...
│ │ ├── Services/ # Page business logic
│ │ │ ├── Context.php # Rule context builder
│ │ │ ├── Rules.php
│ │ │ └── ...
│ │ ├── Data.php # AJAX data endpoints
│ │ └── Navigation.php # Navigation controller
│ │
│ ├── Core/ # Core container, page classes and services
│ │ ├── Container.php
│ │ ├── Page.php
│ │ ├── FileBasedPage.php # Custom pages from assets/pages/
│ │ └── Services/
│ │
│ ├── Crons/ # Background job handlers
│ │ ├── Base.php # Base cron class
│ │ ├── BaseQueue.php # Base queue handler
│ │ ├── BatchedNewEvents.php
│ │ ├── EnrichmentQueueHandler.php
│ │ ├── RiskScoreQueueHandler.php
│ │ └── ... # Other cron jobs
│ │
│ ├── Dictionary/ # Internationalization (i18n)
│ │ ├── en.php # Dictionary entry point
│ │ └── en/ # English translations
│ │ ├── Additional/ # Per-page translations loaded on demand
│ │ ├── Pages/ # Page-specific translations
│ │ ├── Parts/ # Component translations
│ │ ├── Errors.php # Error messages
│ │ └── All.php # Combined translations
│ │
│ ├── Entities/ # Entity objects (User, Ip, Device, Event, ...)
│ │
│ ├── Interfaces/ # PHP interfaces
│ │ ├── ApiKeyAccessAuthorizationInterface.php
│ │ ├── ApiKeyAccountAccessAuthorizationInterface.php
│ │ └── FraudFlagUpdaterInterface.php
│ │
│ ├── Models/ # Database models (extend Base)
│ │ ├── Base.php # Base class with execQuery()
│ │ ├── Device.php # Device/user-agent model
│ │ ├── Api/ # API models
│ │ ├── Chart/ # Chart data models
│ │ ├── Context/ # Rule context data models
│ │ ├── Enrichment/ # Enrichment models
│ │ ├── Grid/ # Grid data models
│ │ ├── Query/ # Query builder
│ │ ├── Search/ # Global search models
│ │ ├── TopTen/ # Dashboard top-ten models
│ │ ├── UserDetails/ # Entity details models
│ │ └── ... # Other models
│ │
│ ├── Updates/ # Database migration handlers
│ │
│ ├── Utils/ # Utility classes
│ │ ├── Assets/ # Loaders for rules, presets, pages, lists
│ │ │ └── Lists/ # Built-in default pattern lists
│ │ ├── Http/ # HTTP client
│ │ ├── ApiKeys.php # API key utilities
│ │ ├── Constants.php # Application constants
│ │ ├── DictManager.php # Additional dictionary loader
│ │ ├── Logger.php # Logging utilities
│ │ ├── Rules.php # Rule utilities
│ │ ├── Variables.php # Configuration/environment variables
│ │ └── ... # Other utilities
│ │
│ └── Views/ # Response renderers (Frontend, Json, Xml)
│
├── assets/ # Static assets, rules and customization points
│ ├── dashboard/ # Dashboard constants
│ ├── rules/ # Rules engine
│ │ ├── core/ # Core rule definitions and presets
│ │ └── custom/ # Custom rules, context and presets
│ ├── lists/ # Suspicious pattern lists
│ │ ├── url.php # URL attack patterns
│ │ ├── user-agent.php # User agent patterns
│ │ ├── ai-bot.php # AI agent/bot user agent substrings
│ │ ├── asn.php # Suspicious ASN numbers
│ │ ├── email.php # Email patterns
│ │ └── file-extensions.php # File extension categories
│ ├── pages/ # Custom pages
│ │ └── views/ # Custom page templates
│ └── logs/ # Application logs
│
├── config/ # Configuration files
│ ├── config.ini # Main configuration
│ ├── routes.ini # Route definitions
│ ├── apiEndpoints.ini # API endpoint definitions
│ ├── crons.ini # Cron job configuration
│ └── local/ # Local overrides (config.local.ini)
│
├── install/ # Web-based installation wizard
│ ├── index.php # DELETE AFTER INSTALLATION
│ └── install.sql # Database schema
│
├── libs/ # Third-party libraries (vendor)
│
├── sensor/ # API endpoint for event ingestion
│
├── tmp/ # Temporary files, cache
│
├── ui/ # Frontend UI
│ ├── css/ # Stylesheets
│ ├── images/ # Static images
│ │ ├── icons/
│ │ └── flags/
│ ├── js/ # JavaScript files
│ │ ├── endpoints/ # Page entry points
│ │ ├── pages/ # Page controllers
│ │ │ ├── Base.js # Base page class
│ │ │ ├── Ips.js # IPs page
│ │ │ ├── Events.js # Events page
│ │ │ └── ... # Other pages
│ │ ├── parts/ # Reusable components
│ │ │ ├── button/ # Action button components
│ │ │ ├── grid/ # Data grid components
│ │ │ ├── chart/ # Chart components (uPlot)
│ │ │ ├── panel/ # Detail panel components
│ │ │ ├── choices/ # Filter components (Choices.js)
│ │ │ ├── details/ # Detail view components
│ │ │ ├── popup/ # Popup/modal components
│ │ │ ├── utils/ # Utility modules
│ │ │ │ ├── Constants.js
│ │ │ │ ├── DataSource.js
│ │ │ │ ├── Date.js
│ │ │ │ ├── ErrorHandler.js
│ │ │ │ ├── Event.js
│ │ │ │ ├── Functions.js
│ │ │ │ └── String.js
│ │ │ └── ... # Other components
│ │ └── vendor/ # Third-party JS libraries
│ │ ├── jquery-3.6.0/
│ │ ├── datatables-2.3.2/
│ │ ├── uPlot-1.6.18/
│ │ ├── choices-10.2.0/
│ │ ├── jvectormap-2.0.5/
│ │ ├── tooltipster-master-4.2.8/
│ │ ├── accept-language-parser-1.5.0/
│ │ └── devbridge-jquery-autocomplete-1.5.0/
│ └── templates/ # HTML templates
│ ├── layout.html # Base layout
│ ├── internalTemplate.html # Wrapper for logged-in pages
│ ├── externalTemplate.html # Wrapper for login/signup pages
│ ├── pages/ # Page templates
│ │ ├── events.html
│ │ ├── ip.html
│ │ ├── users.html
│ │ ├── login.html
│ │ ├── signup.html
│ │ └── ...
│ ├── parts/ # Component templates
│ │ ├── internalHeader.html
│ │ ├── internalFooter.html
│ │ ├── leftMenu.html
│ │ ├── notification.html
│ │ ├── forms/
│ │ ├── home/
│ │ ├── panel/
│ │ ├── popups/
│ │ ├── tables/
│ │ ├── widgets/
│ │ └── choices/
│ └── snippets/ # Code snippets (cURL, PHP, Python, Node.js)
│
├── index.php # Application entry point
├── .htaccess # Apache URL rewriting rules
├── .profile # Environment profile
├── .phpstorm.meta.php # PhpStorm IDE metadata
├── app.json # Platform deployment manifest
├── composer.json # PHP dependencies
├── composer.lock # Locked dependency versions
├── cron.json # Cron job definitions
├── phpcs.xml # PHP CodeSniffer configuration
├── phpstan.neon # PHPStan configuration
├── phpunit.xml # PHPUnit configuration
├── eslint.config.js # JavaScript linting configuration
│
├── CHANGELOG.md # Version history
├── CODE_OF_CONDUCT.md # Community guidelines
├── LICENSE # AGPL-3.0 license
├── LEGALNOTICE.md # Legal notices
├── README.md # Project overview
├── RELEASE_NOTES.md # Release notes
├── SECURITY.md # Security policy
├── FILE_ID.DIZ # BBS-style file description
└── robots.txt # Search engine directives |