Backend (Django)

The backend is a Django REST API served by Gunicorn (port 9020) with a Celery worker for background jobs and a separate Celery beat container (suspicious_celery_beat) for the periodic schedule. It is organised into focused apps; each page below documents one.

App	Responsibility
api	REST endpoints and permissions
case_handler	Case CRUD and lifecycle
cortex_job	Cortex orchestration; Analyzer, AnalyzerReport, CaseAnalyzerJob
score_process	Risk scoring; rule-based verdict explanation and narration prompt-building
connectors	Plugin framework for external integrations (TheHive, MISP, Watcher, SMTP, ChromaDB, ai_narration, case_search, elastic_siem, xsoar, ai_model)
ai_model	Mail AI model lifecycle: AiAssessment, label ledger, model registry, retrain, shadow and promotion; REST under /api/ai-model/
common	Shared infrastructure, no models or routes: object-store providers (common/storage: S3-compatible and GCS), cache locks, the circuit-breaker HTTP client, safe-exec helpers and migration utilities
email_process	Email parsing and submission
Observable processors	domain / url / ip / hash / file analysis
dashboard	KPI metrics
mail_feeder	Outbound SMTP notification templates
tasp	Celery beat schedule + task wrappers
settings	DB-backed config (blacklists, whitelists, campaigns)
profiles	User profile management

submission_queue is still in INSTALLED_APPS only so its migration can drop the obsolete table (see Model conventions); it has no code to document.

Writing or changing a model? Read the model conventions and safe-change guide first.

Code lives under Suspicious/Suspicious/<app>/. Selected models and tasks are auto-documented in the Python Code Reference.