PTahSecurity Alert Center (SAC)
Self-hosted hub for security events from Linux and Windows agents: ingest, correlation, UI, notifications, host management.
Русский: README.md
Repositories
| Repository | Role |
|---|---|
| ssh-monitor | Linux agent |
| RDP-login-monitor | Windows agent |
| security-alert-center | SAC server (Ubuntu 24.04) |
| seaca | Android client |
Version: 0.5.18 · Deploy: sudo /opt/sac-deploy.sh
Features
- Ingest from agents (contract): SSH/sudo/logind, RDP/RDG/WinRM/SMB, heartbeat, reports, inventory
- Problems — auto-correlation (incl. RDG 302→303 flap within 1–10 s)
- Notifications — Telegram, email, webhook, FCM (Seaca)
- Web UI — events, hosts, problems, reports, dashboard (SSE), settings (admin)
- RDG flap — badge on 302/303 events, qwinsta/logoff via WinRM to client PC (domain admin required); optional auto-disconnect of stuck sessions
- Hosts — agent status, inventory, agent updates (SSH/WinRM); WinRM RDP: SAC fetches from git, client downloads zip from SAC, runs local
Deploy-LoginMonitor.ps1(no git on PC) - Mobile — enrollment, devices, push; Seaca: ack/resolve, qwinsta/logoff via SAC API
- Roles —
admin/monitor - Security (0.5.0) — SSH host-key verification, SSE via httpOnly cookie, anti-spoof login rate limit,
SAC_SECURITY_ENFORCE, HMAC API keys
Documentation
| Document | Description |
|---|---|
| docs/agent-integration.md | Agents, UseSAC, event types |
| docs/agent-control-plane.md | RDG flap, qwinsta, agent updates |
| docs/install-ubuntu-24.04-native.md | Native install |
| docs/deployment.md | Operations |
Quick start
git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
# deploy/env.native.example → config/sac-api.env
cd /opt/security-alert-center/backend && python3 -m venv .venv
.venv/bin/pip install -r requirements.txt && .venv/bin/alembic upgrade head
License
MIT — LICENSE.