Security Alert Center (SAC)

Self-hosted hub for collecting, storing, and displaying security events from Linux and Windows hosts.

Русский: README.md

Agents (separate repositories)

Repository	Role
ssh-monitor	Linux: SSH, sudo, logind, brute-force, IP ban
RDP-login-monitor	Windows: RDP/RDS, RD Gateway, WinRM, admin share C$/ADMIN$
security-alert-center (this repo)	Ubuntu 24.04: API, database, UI, notifications

Status

Version: 0.9.0
Stack: FastAPI, PostgreSQL, Vue 3, JWT, SSE
Deploy: sudo /opt/sac-deploy.sh (see deploy/sac-deploy.sh)

UI screenshots

Overview	Events	Problems

What is monitored

Agents send events via the ingest contract (type, severity, details):

• Linux — ssh-monitor: SSH success/failure, sudo, systemd-logind, brute-force and IP ban (ipset), thresholds without ban, daily report, heartbeat.
• Windows — RDP-login-monitor:
  • RDP/RDS (4624/4625);
  • RD Gateway (302/303), WinRM / PowerShell Remoting (Enter-PSSession, event ID 91);
  • admin shares C$ / ADMIN$ (Security 5140, smb.admin_share.access);
  • RDS Shadow Control (RCM 20506/20507/20510), account lockout 4740, daily report, heartbeat, hardware inventory (agent.inventory).
• SAC platform: problems (correlation), Telegram/email/webhook, UI login rate limit, SSE dashboard and live host updates, agent online/stale by heartbeat, host detail with hardware snapshot.

Event type examples: ssh.login.*, privilege.sudo.command, rdp.login.*, winrm.session.started, smb.admin_share.access, agent.heartbeat, agent.inventory, report.daily.* — full mapping.

Platform features

• Roles admin / monitor, user management in UI, JWT validated against DB
• Events, hosts, problems, dashboard, reports, live SSE
• Notifications: Telegram, email, webhook; problem rules and cooldowns
• SPA hardening, admin-only DELETE /hosts, login rate limit, DOMPurify for report_html
• Custom error pages: 401 / 403 / 404 / 429
• Sidebar system stats (CPU, RAM, disk, DB latency)

Documentation

Document	Description
docs/TZ.md	Technical specification (Russian)
docs/architecture.md	Architecture
docs/agent-integration.md	Agent integration (UseSAC modes)
docs/event-schema-v1.json	Event JSON Schema v1
docs/install-ubuntu-24.04-native.md	Ubuntu 24.04 native install
docs/install-ubuntu-24.04-docker.md	Docker alternative
docs/deployment.md	Deployment and operations
docs/ssl-certificate.md	TLS certificate setup
docs/runbook-ops.md	Operations runbook

Quick start (native)

git clone https://github.com/PTah/security-alert-center.git /opt/security-alert-center
# deploy/env.native.example -> config/sac-api.env
cd /opt/security-alert-center/backend
python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
.venv/bin/alembic upgrade head

Full guide: docs/install-ubuntu-24.04-native.md

Target platform

• SAC server: Ubuntu 24.04 LTS
• Agents: ssh-monitor (Linux), RDP-login-monitor (Windows)

GitHub topics

security-monitoring, siem, incident-response, fastapi, vue, postgresql, telegram-bot, webhook, jwt, rbac, self-hosted

License

MIT — see LICENSE.
Copyright (c) 2026 Andrey "PapaTramp" Lutsenko.