Lucas RayanandClaude Sonnet 5
1b974bb90d
Acauã: Network Detection & Threat Hunting, heuristic analysis over a rolling 7-day window using deterministic math (time series, graph theory, information theory) instead of opaque ML models. Third product in the Ciberfauna ecosystem, alongside Guará and Sabiá. Follows the ecosystem's established conventions: OpenWolf project memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the same self-hosted runners, Conventional Commits, SemVer, logo and productName handling, MIT OR Apache-2.0 licensing. Architecture decision (made with the project owner after a dedicated consultation, not the original blueprint's suggested stack): Rust throughout, not Python/FastAPI/React. Most of the statistics (Bowley skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection, pivot chains) reduces to SQL over an embedded DuckDB/Parquet store; only the spectral analysis and graph centrality need host-language code, and both have workable Rust crates. Documented in full, including six corrections to the original blueprint's math (Rayleigh/Schuster instead of a degenerate Lomb-Scargle over bare timestamps, an explicit sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+ licensing caution, deterministic per-alert evidence), in docs/architecture.md. Skeleton only: crates/acaua-core has the four detection pillars, fusion, storage, zeek log parsing and the updater as typed stubs that compile and return a clear "skeleton" status rather than real detection logic — that is separate, future work. crates/acaua-cli has serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also already includes the one-click desktop self-update mechanism shared with Guará and Sabiá (AppImage/.deb/Windows installer), even with no release published yet, for consistency across the ecosystem. No Gitea repository exists for this project yet; this is a local-only commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
3.0 KiB
Terminal
English · Português
The acaua binary is both the CLI and the daemon. This page describes the
commands that exist in the 0.1.0 skeleton. Detection is not implemented yet;
analyze validates input and returns a stub report.
acaua <command> [options]
Commands:
serve Start the API and embedded UI
analyze Analyze a Zeek log directory
doctor Check the local environment
update Check or apply a CLI update
acaua serve
Starts the HTTP API and the embedded UI.
acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
| Option | Default | Meaning |
|---|---|---|
--bind |
127.0.0.1:8787 |
Listen address |
--data-dir |
.acaua |
Store and runtime files |
The default bind is loopback-only. Exposing the daemon on a network requires a reverse proxy with authentication. The API is documented in architecture.md.
acaua analyze
acaua analyze /var/log/zeek/current
acaua analyze /var/log/zeek/current --json
The directory is validated and a report is printed. In this skeleton the parser
does not read Zeek records yet: logs seen and records are placeholders, and
alerts is empty. The command is still useful to check path handling and the
JSON shape.
The future parser will support conn.log, dns.log, ssl.log and the protocol
logs needed for identity and lateral-movement features. NetFlow/IPFIX is a
degraded mode; it is not equivalent to full protocol logs.
acaua doctor
acaua doctor
acaua doctor --json
Prints checks for Zeek, curl, tar, the optional DuckDB feature and the
isolation of research/, followed by the status (skeleton in 0.1.0). A
missing optional dependency is reported as falha but does not abort the
command. It does not send telemetry.
acaua update
acaua update
acaua update --apply
update queries the latest Gitea Release, compares the tag with the running
version and prints whether an update exists. --apply downloads the archive for
the current platform, verifies its SHA-256, extracts it and replaces the
acaua binary.
Requirements: curl and tar on PATH, and a writable binary location. The
updater refuses to replace any executable whose name is not acaua; the desktop
app must be updated through its installer. A failed checksum leaves the current
binary untouched.
Exit codes
| Code | Meaning |
|---|---|
0 |
Success |
1 |
Runtime error (invalid path, failed update, I/O error) |
2 |
Invalid command-line usage (clap) |
Environment
The skeleton has no required environment variable. RUST_LOG is reserved for
the future tracing layer. The default data directory is relative to the current
working directory; use an absolute path for a system service.
Examples
# Local lab
acaua doctor
acaua analyze ./fixtures/zeek --json
acaua serve --bind 127.0.0.1:8787 --data-dir ./.acaua
# Container
docker run --rm -p 127.0.0.1:8787:8787 -v "$PWD/zeek:/data:ro" acaua serve
See docker.md for the image and volume layout.