PapaTramp
3f671b9899
Send title and body in the data payload instead of notification block so onMessageReceived always runs and the app can honour silent mode in background. Co-authored-by: Cursor <cursoragent@cursor.com>
Security Alert Center (SAC)
Self-hosted hub for collecting, storing, and displaying security events from Linux and Windows hosts.
Русский: README.md
Agents (separate repositories)
| Repository | Role |
|---|---|
| ssh-monitor | Linux: SSH, sudo, logind, brute-force, IP ban |
| RDP-login-monitor | Windows: RDP/RDS, RD Gateway, WinRM, admin share C$/ADMIN$ |
| security-alert-center (this repo) | Ubuntu 24.04: API, database, UI, notifications |
Status
Version: 0.8.3
Stack: FastAPI, PostgreSQL, Vue 3, JWT, SSE
Deploy: sudo /opt/sac-deploy.sh (see deploy/sac-deploy.sh)
UI screenshots
| Overview | Events | Problems |
|---|---|---|
 |
 |
 |
What is monitored
Agents send events via the ingest contract (type, severity, details):
- Linux — ssh-monitor: SSH success/failure, sudo, systemd-logind, brute-force and IP ban (ipset), thresholds without ban, daily report, heartbeat.
- Windows — RDP-login-monitor:
- RDP/RDS (4624/4625);
- RD Gateway (302/303), WinRM / PowerShell Remoting (Enter-PSSession, event ID 91);
- admin shares
C$/ADMIN$(Security 5140,smb.admin_share.access); - RDS Shadow Control (RCM 20506/20507/20510), account lockout 4740, daily report, heartbeat, hardware inventory (
agent.inventory).
- SAC platform: problems (correlation), Telegram/email/webhook, UI login rate limit, SSE dashboard and live host updates, agent online/stale by heartbeat, host detail with hardware snapshot.
Event type examples: ssh.login.*, privilege.sudo.command, rdp.login.*, winrm.session.started, smb.admin_share.access, agent.heartbeat, agent.inventory, report.daily.* — full mapping.
Platform features
- Roles
admin/monitor, user management in UI, JWT validated against DB - Events, hosts, problems, dashboard, reports, live SSE
- Notifications: Telegram, email, webhook; problem rules and cooldowns
- SPA hardening, admin-only
DELETE /hosts, login rate limit, DOMPurify forreport_html - Custom error pages:
401/403/404/429 - Sidebar system stats (CPU, RAM, disk, DB latency)
Documentation
| Document | Description |
|---|---|
| docs/TZ.md | Technical specification (Russian) |
| docs/architecture.md | Architecture |
| docs/agent-integration.md | Agent integration (UseSAC modes) |
| docs/event-schema-v1.json | Event JSON Schema v1 |
| docs/install-ubuntu-24.04-native.md | Ubuntu 24.04 native install |
| docs/install-ubuntu-24.04-docker.md | Docker alternative |
| docs/deployment.md | Deployment and operations |
| docs/ssl-certificate.md | TLS certificate setup |
| docs/runbook-ops.md | Operations runbook |
Quick start (native)
git clone https://github.com/PTah/security-alert-center.git /opt/security-alert-center
# deploy/env.native.example -> config/sac-api.env
cd /opt/security-alert-center/backend
python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
.venv/bin/alembic upgrade head
Full guide: docs/install-ubuntu-24.04-native.md
Target platform
- SAC server: Ubuntu 24.04 LTS
- Agents: ssh-monitor (Linux), RDP-login-monitor (Windows)
GitHub topics
security-monitoring, siem, incident-response, fastapi, vue, postgresql, telegram-bot, webhook, jwt, rbac, self-hosted
License
MIT — see LICENSE.
Copyright (c) 2026 Andrey "PapaTramp" Lutsenko.