docs: split README (RU) and README_en (EN) for GitHub

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-05 14:38:53 +10:00
parent 95c5b9f25a
commit 459b2babd1
2 changed files with 132 additions and 40 deletions
@@ -0,0 +1,88 @@
+# Security Alert Center (SAC)
+
+Self-hosted hub for collecting, storing, and displaying security events from Linux and Windows hosts.
+
+**Русский:** [README.md](README.md)
+
+## Agents (separate repositories)
+
+| Repository | Role |
+|------------|------|
+| [ssh-monitor](https://github.com/PTah/ssh-monitor) | Linux: SSH, sudo, logind, brute-force, IP ban |
+| [RDP-login-monitor](https://github.com/PTah/RDP-login-monitor) | Windows: RDP/RDS, RD Gateway, WinRM, admin share C$/ADMIN$ |
+| **security-alert-center** (this repo) | Ubuntu 24.04: API, database, UI, notifications |
+
+## Status
+
+**Version:** `0.8.2`  
+**Stack:** FastAPI, PostgreSQL, Vue 3, JWT, SSE  
+**Deploy:** `sudo /opt/sac-deploy.sh` (see `deploy/sac-deploy.sh`)
+
+## UI screenshots
+
+| Overview | Events | Problems |
+|----------|--------|----------|
+| ![SAC dashboard](docs/screenshots/ui-overview.png) | ![SAC events](docs/screenshots/ui-events.png) | ![SAC problems](docs/screenshots/ui-problems.png) |
+
+## What is monitored
+
+Agents send events via the [ingest contract](docs/agent-integration.md) (`type`, `severity`, `details`):
+
+- **Linux — [ssh-monitor](https://github.com/PTah/ssh-monitor):** SSH success/failure, **sudo**, **systemd-logind**, brute-force and IP ban (ipset), thresholds without ban, daily report, heartbeat.
+- **Windows — [RDP-login-monitor](https://github.com/PTah/RDP-login-monitor):**
+  - **RDP/RDS** (4624/4625);
+  - **RD Gateway** (302/303), **WinRM / PowerShell Remoting** (Enter-PSSession, event ID 91);
+  - **admin shares `C$` / `ADMIN$`** (Security **5140**, `smb.admin_share.access`);
+  - **RDS Shadow Control** (RCM 20506/20507/20510), account lockout **4740**, daily report, heartbeat, **hardware inventory** (`agent.inventory`).
+- **SAC platform:** problems (correlation), Telegram/email/webhook, UI login rate limit, SSE dashboard and live host updates, agent online/stale by heartbeat, host detail with hardware snapshot.
+
+**Event type examples:** `ssh.login.*`, `privilege.sudo.command`, `rdp.login.*`, `winrm.session.started`, `smb.admin_share.access`, `agent.heartbeat`, `agent.inventory`, `report.daily.*` — [full mapping](docs/agent-integration.md#3-маппинг-уведомлений--типы-событий).
+
+## Platform features
+
+- Roles `admin` / `monitor`, user management in UI, JWT validated against DB
+- Events, hosts, problems, dashboard, reports, live SSE
+- Notifications: Telegram, email, webhook; problem rules and cooldowns
+- SPA hardening, admin-only `DELETE /hosts`, login rate limit, DOMPurify for `report_html`
+- Custom error pages: `401` / `403` / `404` / `429`
+- Sidebar system stats (CPU, RAM, disk, DB latency)
+
+## Documentation
+
+| Document | Description |
+|----------|-------------|
+| [docs/TZ.md](docs/TZ.md) | Technical specification (Russian) |
+| [docs/architecture.md](docs/architecture.md) | Architecture |
+| [docs/agent-integration.md](docs/agent-integration.md) | Agent integration (`UseSAC` modes) |
+| [docs/event-schema-v1.json](docs/event-schema-v1.json) | Event JSON Schema v1 |
+| [docs/install-ubuntu-24.04-native.md](docs/install-ubuntu-24.04-native.md) | **Ubuntu 24.04 native install** |
+| [docs/install-ubuntu-24.04-docker.md](docs/install-ubuntu-24.04-docker.md) | Docker alternative |
+| [docs/deployment.md](docs/deployment.md) | Deployment and operations |
+| [docs/ssl-certificate.md](docs/ssl-certificate.md) | TLS certificate setup |
+| [docs/runbook-ops.md](docs/runbook-ops.md) | Operations runbook |
+
+## Quick start (native)
+
+```bash
+git clone https://github.com/PTah/security-alert-center.git /opt/security-alert-center
+# deploy/env.native.example -> config/sac-api.env
+cd /opt/security-alert-center/backend
+python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
+.venv/bin/alembic upgrade head
+```
+
+Full guide: [docs/install-ubuntu-24.04-native.md](docs/install-ubuntu-24.04-native.md)
+
+## Target platform
+
+- **SAC server:** Ubuntu 24.04 LTS
+- **Agents:** ssh-monitor (Linux), RDP-login-monitor (Windows)
+
+## GitHub topics
+
+`security-monitoring`, `siem`, `incident-response`, `fastapi`, `vue`, `postgresql`, `telegram-bot`, `webhook`, `jwt`, `rbac`, `self-hosted`
+
+## License
+
+MIT — see [LICENSE](LICENSE).  
+Copyright (c) 2026 Andrey "PapaTramp" Lutsenko.