docs: refresh README; allow monitor JWT for RDG qwinsta/logoff (0.20.6)
Update platform docs for current features; Seaca and web operators with monitor role can trigger WinRM actions via SAC API.
This commit is contained in:
PTah
+24
-63
@@ -1,88 +1,49 @@
|
||||
# Security Alert Center (SAC)
|
||||
|
||||
Self-hosted hub for collecting, storing, and displaying security events from Linux and Windows hosts.
|
||||
Self-hosted hub for security events from Linux and Windows agents: ingest, correlation, UI, notifications, host management.
|
||||
|
||||
**Русский:** [README.md](README.md)
|
||||
|
||||
## Agents (separate repositories)
|
||||
## Repositories
|
||||
|
||||
| Repository | Role |
|
||||
|------------|------|
|
||||
| [ssh-monitor](https://git.kalinamall.ru/PapaTramp/ssh-monitor) | Linux: SSH, sudo, logind, brute-force, IP ban |
|
||||
| [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor) | Windows: RDP/RDS, RD Gateway, WinRM, admin share C$/ADMIN$ |
|
||||
| **security-alert-center** (this repo) | Ubuntu 24.04: API, database, UI, notifications |
|
||||
| [ssh-monitor](https://git.kalinamall.ru/PapaTramp/ssh-monitor) | Linux agent |
|
||||
| [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor) | Windows agent |
|
||||
| **security-alert-center** | SAC server (Ubuntu 24.04) |
|
||||
| [seaca](https://git.kalinamall.ru/PapaTramp/seaca) | Android client |
|
||||
|
||||
## Status
|
||||
**Version:** `0.20.6` · **Deploy:** `sudo /opt/sac-deploy.sh`
|
||||
|
||||
**Version:** `0.10.0`
|
||||
**Stack:** FastAPI, PostgreSQL, Vue 3, JWT, SSE
|
||||
**Deploy:** `sudo /opt/sac-deploy.sh` (see `deploy/sac-deploy.sh`)
|
||||
## Features
|
||||
|
||||
## UI screenshots
|
||||
|
||||
| Overview | Events | Problems |
|
||||
|----------|--------|----------|
|
||||
|  |  |  |
|
||||
|
||||
## What is monitored
|
||||
|
||||
Agents send events via the [ingest contract](docs/agent-integration.md) (`type`, `severity`, `details`):
|
||||
|
||||
- **Linux — [ssh-monitor](https://git.kalinamall.ru/PapaTramp/ssh-monitor):** SSH success/failure, **sudo**, **systemd-logind**, brute-force and IP ban (ipset), thresholds without ban, daily report, heartbeat.
|
||||
- **Windows — [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor):**
|
||||
- **RDP/RDS** (4624/4625);
|
||||
- **RD Gateway** (302/303), **WinRM / PowerShell Remoting** (Enter-PSSession, event ID 91);
|
||||
- **admin shares `C$` / `ADMIN$`** (Security **5140**, `smb.admin_share.access`);
|
||||
- **RDS Shadow Control** (RCM 20506/20507/20510), account lockout **4740**, daily report, heartbeat, **hardware inventory** (`agent.inventory`).
|
||||
- **SAC platform:** problems (correlation), Telegram/email/webhook, UI login rate limit, SSE dashboard and live host updates, agent online/stale by heartbeat, host detail with hardware snapshot.
|
||||
|
||||
**Event type examples:** `ssh.login.*`, `privilege.sudo.command`, `rdp.login.*`, `winrm.session.started`, `smb.admin_share.access`, `agent.heartbeat`, `agent.inventory`, `report.daily.*` — [full mapping](docs/agent-integration.md#3-маппинг-уведомлений--типы-событий).
|
||||
|
||||
## Platform features
|
||||
|
||||
- Roles `admin` / `monitor`, user management in UI, JWT validated against DB
|
||||
- Events, hosts, problems, dashboard, reports, live SSE
|
||||
- Notifications: Telegram, email, webhook; problem rules and cooldowns
|
||||
- SPA hardening, admin-only `DELETE /hosts`, login rate limit, DOMPurify for `report_html`
|
||||
- Custom error pages: `401` / `403` / `404` / `429`
|
||||
- Sidebar system stats (CPU, RAM, disk, DB latency)
|
||||
- **Ingest** from agents ([contract](docs/agent-integration.md)): SSH/sudo/logind, RDP/RDG/WinRM/SMB, heartbeat, reports, inventory
|
||||
- **Problems** — auto-correlation (incl. RDG 302→303 flap within 1–10 s)
|
||||
- **Notifications** — Telegram, email, webhook, FCM (Seaca)
|
||||
- **Web UI** — events, hosts, problems, reports, dashboard (SSE), settings (admin)
|
||||
- **RDG flap** — badge on 302/303 events, **qwinsta/logoff** via WinRM to client PC (domain admin required)
|
||||
- **Hosts** — agent status, inventory, agent updates (SSH/WinRM), connectivity tests
|
||||
- **Mobile** — enrollment, devices, push; Seaca: ack/resolve, qwinsta/logoff via SAC API
|
||||
- **Roles** — `admin` / `monitor`
|
||||
|
||||
## Documentation
|
||||
|
||||
| Document | Description |
|
||||
|----------|-------------|
|
||||
| [docs/TZ.md](docs/TZ.md) | Technical specification (Russian) |
|
||||
| [docs/architecture.md](docs/architecture.md) | Architecture |
|
||||
| [docs/agent-integration.md](docs/agent-integration.md) | Agent integration (`UseSAC` modes) |
|
||||
| [docs/event-schema-v1.json](docs/event-schema-v1.json) | Event JSON Schema v1 |
|
||||
| [docs/install-ubuntu-24.04-native.md](docs/install-ubuntu-24.04-native.md) | **Ubuntu 24.04 native install** |
|
||||
| [docs/install-ubuntu-24.04-docker.md](docs/install-ubuntu-24.04-docker.md) | Docker alternative |
|
||||
| [docs/deployment.md](docs/deployment.md) | Deployment and operations |
|
||||
| [docs/ssl-certificate.md](docs/ssl-certificate.md) | TLS certificate setup |
|
||||
| [docs/runbook-ops.md](docs/runbook-ops.md) | Operations runbook |
|
||||
| [docs/agent-integration.md](docs/agent-integration.md) | Agents, `UseSAC`, event types |
|
||||
| [docs/agent-control-plane.md](docs/agent-control-plane.md) | RDG flap, qwinsta, agent updates |
|
||||
| [docs/install-ubuntu-24.04-native.md](docs/install-ubuntu-24.04-native.md) | Native install |
|
||||
| [docs/deployment.md](docs/deployment.md) | Operations |
|
||||
|
||||
## Quick start (native)
|
||||
## Quick start
|
||||
|
||||
```bash
|
||||
git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
|
||||
# deploy/env.native.example -> config/sac-api.env
|
||||
cd /opt/security-alert-center/backend
|
||||
python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
|
||||
.venv/bin/alembic upgrade head
|
||||
cd /opt/security-alert-center/backend && python3 -m venv .venv
|
||||
.venv/bin/pip install -r requirements.txt && .venv/bin/alembic upgrade head
|
||||
```
|
||||
|
||||
Full guide: [docs/install-ubuntu-24.04-native.md](docs/install-ubuntu-24.04-native.md)
|
||||
|
||||
## Target platform
|
||||
|
||||
- **SAC server:** Ubuntu 24.04 LTS
|
||||
- **Agents:** ssh-monitor (Linux), RDP-login-monitor (Windows)
|
||||
|
||||
## GitHub topics
|
||||
|
||||
`security-monitoring`, `siem`, `incident-response`, `fastapi`, `vue`, `postgresql`, `telegram-bot`, `webhook`, `jwt`, `rbac`, `self-hosted`
|
||||
|
||||
## License
|
||||
|
||||
MIT — see [LICENSE](LICENSE).
|
||||
Copyright (c) 2026 Andrey "PapaTramp" Lutsenko.
|
||||
MIT — [LICENSE](LICENSE).
|
||||
|
||||
Reference in New Issue
Block a user