OrientDB is a multi-model NoSQL database management system supporting document, graph, object, and relational data models within a single engine. It provides ACID transactions, a SQL-like query language, distributed clustering with automatic sharding and replication, full-text and spatial indexing via Lucene, and a Gremlin graph traversal API. The system is implemented in Java and organized into modular components: a core storage engine with pluggable index structures (SB-Tree, hash, Lucene), a binary client-server protocol, an HTTP REST API, and a web-based administration studio (AngularJS). It includes enterprise features such as backup/restore, metrics monitoring, and security auditing. The architecture follows a plugin-based server model, allowing extensions for authentication, indexing, and custom commands. External dependencies include Dropwizard Metrics, Lucene, Gremlin/TinkerPop, and various compression libraries.
KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.