3 Commits

Include renames

Author	SHA1	Message	Date
Lucas RayanandClaude Sonnet 5	be47b607df	feat: build a real dashboard and fix dead panel navigation in the web UI ... The sidebar nav (Overview/Alerts/Analysis) only did scrollIntoView on a single stacked page, so clicking it produced no visible change. The Alerts/Analysis panels were also placeholder shells with no real data exploration despite the API already exposing rich per-pillar evidence. - app.js/app.css/index.html: real panel switching via showView()/currentView, toggling an .active class with `.view:not(.active) { display: none }`; settings keeps opening its own dialog without disturbing the active view. - New Hosts panel: table of observed hosts ranked by fusion score, with per-pillar (P1/P2/P3) columns, search, and drill-down into each pillar's evidence. Documents the known limitation that /api/alerts only lists hosts with at least one alert (no /api/hosts endpoint exists yet), so a benign host with no alert won't appear. - Alerts panel: filterable by pillar and minimum score, sortable, with full evidence rendered as a formatted key/value table instead of raw JSON. - Overview panel: KPI tiles (alert count, hosts with alerts, max score, dataset records) plus two interactive SVG charts (top hosts by fusion score, alert distribution by pillar) with hover tooltips. - i18n-en.js: English strings for all new UI text. No Rust files changed; this is purely apps/gui/ui/ consuming the existing /api/alerts, /api/analyze and /api/status endpoints. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD	2026-11-01 08:28:08 -03:00
Lucas RayanandClaude Sonnet 5	8a80504c45	refactor: distribute Acaua as a Docker image instead of a desktop app ... Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD	2026-10-31 19:54:45 -03:00
Lucas RayanandClaude Sonnet 5	1b974bb90d	chore: initial project skeleton ... Acauã: Network Detection & Threat Hunting, heuristic analysis over a rolling 7-day window using deterministic math (time series, graph theory, information theory) instead of opaque ML models. Third product in the Ciberfauna ecosystem, alongside Guará and Sabiá. Follows the ecosystem's established conventions: OpenWolf project memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the same self-hosted runners, Conventional Commits, SemVer, logo and productName handling, MIT OR Apache-2.0 licensing. Architecture decision (made with the project owner after a dedicated consultation, not the original blueprint's suggested stack): Rust throughout, not Python/FastAPI/React. Most of the statistics (Bowley skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection, pivot chains) reduces to SQL over an embedded DuckDB/Parquet store; only the spectral analysis and graph centrality need host-language code, and both have workable Rust crates. Documented in full, including six corrections to the original blueprint's math (Rayleigh/Schuster instead of a degenerate Lomb-Scargle over bare timestamps, an explicit sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+ licensing caution, deterministic per-alert evidence), in docs/architecture.md. Skeleton only: crates/acaua-core has the four detection pillars, fusion, storage, zeek log parsing and the updater as typed stubs that compile and return a clear "skeleton" status rather than real detection logic — that is separate, future work. crates/acaua-cli has serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also already includes the one-click desktop self-update mechanism shared with Guará and Sabiá (AppImage/.deb/Windows installer), even with no release published yet, for consistency across the ecosystem. No Gitea repository exists for this project yet; this is a local-only commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD	2026-10-31 10:20:03 -03:00