PapaTramp
91be282ec6
Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off.
51 lines
2.3 KiB
Markdown
51 lines
2.3 KiB
Markdown
# Security Alert Center (SAC)
|
||
|
||
Self-hosted hub for security events from Linux and Windows agents: ingest, correlation, UI, notifications, host management.
|
||
|
||
**Русский:** [README.md](README.md)
|
||
|
||
## Repositories
|
||
|
||
| Repository | Role |
|
||
|------------|------|
|
||
| [ssh-monitor](https://git.kalinamall.ru/PapaTramp/ssh-monitor) | Linux agent |
|
||
| [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor) | Windows agent |
|
||
| **security-alert-center** | SAC server (Ubuntu 24.04) |
|
||
| [seaca](https://git.kalinamall.ru/PapaTramp/seaca) | Android client |
|
||
|
||
**Version:** `0.5.12` · **Deploy:** `sudo /opt/sac-deploy.sh`
|
||
|
||
## Features
|
||
|
||
- **Ingest** from agents ([contract](docs/agent-integration.md)): SSH/sudo/logind, RDP/RDG/WinRM/SMB, heartbeat, reports, inventory
|
||
- **Problems** — auto-correlation (incl. RDG 302→303 flap within 1–10 s)
|
||
- **Notifications** — Telegram, email, webhook, FCM (Seaca)
|
||
- **Web UI** — events, hosts, problems, reports, dashboard (SSE), settings (admin)
|
||
- **RDG flap** — badge on 302/303 events, **qwinsta/logoff** via WinRM to client PC (domain admin required); optional auto-disconnect of stuck sessions
|
||
- **Hosts** — agent status, inventory, agent updates (SSH/WinRM); WinRM RDP: SAC fetches from git, client downloads zip from SAC, runs local `Deploy-LoginMonitor.ps1` (no git on PC)
|
||
- **Mobile** — enrollment, devices, push; Seaca: ack/resolve, qwinsta/logoff via SAC API
|
||
- **Roles** — `admin` / `monitor`
|
||
- **Security (0.5.0)** — SSH host-key verification, SSE via httpOnly cookie, anti-spoof login rate limit, `SAC_SECURITY_ENFORCE`, HMAC API keys
|
||
|
||
## Documentation
|
||
|
||
| Document | Description |
|
||
|----------|-------------|
|
||
| [docs/agent-integration.md](docs/agent-integration.md) | Agents, `UseSAC`, event types |
|
||
| [docs/agent-control-plane.md](docs/agent-control-plane.md) | RDG flap, qwinsta, agent updates |
|
||
| [docs/install-ubuntu-24.04-native.md](docs/install-ubuntu-24.04-native.md) | Native install |
|
||
| [docs/deployment.md](docs/deployment.md) | Operations |
|
||
|
||
## Quick start
|
||
|
||
```bash
|
||
git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
|
||
# deploy/env.native.example → config/sac-api.env
|
||
cd /opt/security-alert-center/backend && python3 -m venv .venv
|
||
.venv/bin/pip install -r requirements.txt && .venv/bin/alembic upgrade head
|
||
```
|
||
|
||
## License
|
||
|
||
MIT — [LICENSE](LICENSE).
|