0 Fork 0

Files

T

Lucas RayanandClaude Sonnet 5 1b974bb90d chore: initial project skeleton

Acauã: Network Detection & Threat Hunting, heuristic analysis over a
rolling 7-day window using deterministic math (time series, graph
theory, information theory) instead of opaque ML models. Third
product in the Ciberfauna ecosystem, alongside Guará and Sabiá.

Follows the ecosystem's established conventions: OpenWolf project
memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the
same self-hosted runners, Conventional Commits, SemVer, logo and
productName handling, MIT OR Apache-2.0 licensing.

Architecture decision (made with the project owner after a dedicated
consultation, not the original blueprint's suggested stack): Rust
throughout, not Python/FastAPI/React. Most of the statistics (Bowley
skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection,
pivot chains) reduces to SQL over an embedded DuckDB/Parquet store;
only the spectral analysis and graph centrality need host-language
code, and both have workable Rust crates. Documented in full, including
six corrections to the original blueprint's math (Rayleigh/Schuster
instead of a degenerate Lomb-Scargle over bare timestamps, an explicit
sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of
unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+
licensing caution, deterministic per-alert evidence), in
docs/architecture.md.

Skeleton only: crates/acaua-core has the four detection pillars,
fusion, storage, zeek log parsing and the updater as typed stubs that
compile and return a clear "skeleton" status rather than real
detection logic — that is separate, future work. crates/acaua-cli has
serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also
already includes the one-click desktop self-update mechanism shared
with Guará and Sabiá (AppImage/.deb/Windows installer), even with no
release published yet, for consistency across the ecosystem.

No Gitea repository exists for this project yet; this is a local-only
commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

2026-10-31 10:20:03 -03:00

2.2 KiB

Raw Blame History

Docker

English · Português

The image is for lab and research use. It runs the same acaua binary as a native install, with the embedded UI. The skeleton does not enable the DuckDB feature in the image; the store remains reserved for a later release.

Build

docker build -t acaua .
docker run --rm -p 127.0.0.1:8787:8787 -v "$PWD/data/acaua:/data/acaua" acaua

The build stage uses rust:1-slim-bookworm; the runtime stage uses debian:bookworm-slim and installs only ca-certificates, curl and tar (the updater needs curl and tar).

Compose

cp .env.example .env   # optional: set ZEEK_INTERFACE
docker compose up --build

The Compose file starts two services:

Service	Purpose	Notes
`zeek`	Capture and write Zeek logs to `./data/zeek`	Host network and `NET_RAW`/`NET_ADMIN`
`acaua`	Read logs and serve the UI/API	Host port bound to `127.0.0.1:8787`

acaua mounts ./data/zeek read-only at /data/zeek and ./data/acaua read-write at /data/acaua. The daemon inside the container binds 0.0.0.0:8787, but the published port is loopback-only on the host.

Data layout

data/
  zeek/      # Zeek logs, written by the zeek service
  acaua/     # store, exports and runtime files

Do not mount the host root or a directory containing unrelated sensitive files. The parser is expected to confine paths to the dataset root; the skeleton does not parse records yet.

Security notes

The zeek service needs packet capture privileges. Run it only on an interface and network you are authorized to monitor.
Do not change the host port mapping to 0.0.0.0:8787 without an authenticating reverse proxy.
The image has no telemetry and no outbound connection except an explicit acaua update.
The container is not a sandbox for hostile datasets. Treat a malformed capture as hostile input and keep the container unprivileged.

Limitations

No DuckDB build in the image; the analytical store is not active.
The UI is a shell and analyze returns a stub report.
The image does not include Zeek; the Compose file uses the upstream Zeek image.
There is no published image registry yet. Build locally.

2.2 KiB Raw Blame History