Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
48 lines
2.0 KiB
Markdown
48 lines
2.0 KiB
Markdown
# Roadmap
|
|
|
|
**English** · [Português](ROADMAP.pt-BR.md)
|
|
|
|
This roadmap separates what exists from what is planned. The four pillars are
|
|
**under development**; they represent the core analytical work.
|
|
|
|
## Done
|
|
|
|
- Rust workspace with `acaua-core` and `acaua-cli`.
|
|
- CLI commands, Axum API and embedded web dashboard.
|
|
- 100% Docker containerization, compose deployment, non-root hardened profile.
|
|
- Prebuilt DuckDB linking and Parquet storage foundations.
|
|
- Stubs for the four pillars, evidence fusion, and Zeek ingestion.
|
|
- English/Portuguese documentation, CI/release workflows and `scripts/check.sh`.
|
|
- Deterministic smoke tests and bilingual UI coverage checks.
|
|
|
|
## Next
|
|
|
|
1. **Pillar 1 — beaconing.** Implement the Rayleigh/Schuster periodogram on
|
|
event timestamps, add harmonic resistance, and verify with deterministic fixtures.
|
|
2. **Pillar 2 — persistent sessions.** Detect long connections that never
|
|
produce a short interval, with explicit thresholds and no overlap with
|
|
pillar 1.
|
|
3. **Real Zeek parser.** Read `conn.log`, `dns.log`, `ssl.log` and protocol logs
|
|
with bounded memory, path confinement and deterministic ordering.
|
|
4. **Evidence record.** Emit a JSON record per alert with inputs, intermediate
|
|
values, code version and dataset hash.
|
|
|
|
## Later
|
|
|
|
- Pillar 3 — deterministic protocol anomalies, including identity and
|
|
lateral-movement features.
|
|
- Pillar 4 — bounded, symmetric fusion with reproducible weights.
|
|
- Analytical store optimizations, daily Parquet partitioning and TTL pruning.
|
|
- Scheduled ingestion and automated log rotation handling in daemon mode.
|
|
- NetFlow/IPFIX as a documented degraded mode and Suricata EVE JSON as an
|
|
optional secondary input.
|
|
- Signed release metadata, SBOM and reproducible builds.
|
|
|
|
## Non-goals
|
|
|
|
- Opaque AI scoring that cannot explain an alert.
|
|
- A required cloud service or telemetry pipeline.
|
|
- Python in the shipped runtime.
|
|
- Treating flow records as equivalent to full Zeek protocol logs.
|
|
- Native desktop shell or binary self-mutation.
|