Lucas RayanandClaude Sonnet 5
8a80504c45
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
1.6 KiB
Interface
English · Português
The interface is a vanilla HTML/CSS/JS dashboard embedded directly into the
acaua binary via rust-embed and served by acaua serve. There is no
frontend build step and no heavy framework runtime.
Layout
- Sidebar: brand logo, navigation, daemon connection indicator, version and update check.
- Overview: monitoring scope notice, authorized-use warning and four detection pillar cards.
- Analysis: dataset path entry, analyze button, refresh and raw JSON output inspection.
- Alerts: list of alerts with deterministic evidence metadata.
- Settings: language and theme preferences, stored in browser local storage.
Language
The source text is Portuguese. i18n.js applies English translations from
i18n-en.js at runtime and persists the selection in localStorage. Auto
detects the browser language. The automated test node scripts/check-ui-i18n.mjs
guarantees that every visible Portuguese string has an exact English pair.
Theme
Light, dark and Auto modes are supported. Auto reacts to system
prefers-color-scheme. Preferences stay local; no telemetry is sent.
Connection state
The interface communicates with /api/health and displays:
- Connecting: initial connection in progress.
- Local service online: daemon is responding.
- Service unavailable: connection to daemon failed; interface remains accessible for offline settings.
Analysis view
Posting a directory path to /api/analyze triggers the Zeek ingestion and
analytical detection pipeline.